Race Condition Vulnerability in Apache Camel PQC Component

CVE-2026-85248

What is CVE-2026-85248?

A race condition exists in the Apache Camel PQC component due to improper synchronization when using a shared java.security.Signature instance for multiple exchanges. This vulnerability can lead to verification processes erroneously returning successful results for incorrect signatures, as the instance accumulates state across concurrent requests. To mitigate this issue, users should upgrade to Apache Camel 4.23.0 or utilize version 4.18.5 or 4.22.1 depending on their LTS release stream. For short-term solutions, restricting routes to a single concurrent consumer is recommended to prevent interleaving of update and verify calls.

References