Deserialization Vulnerability in Apache Camel JGroups Component

CVE-2026-88900

What is CVE-2026-88900?

A deserialization vulnerability exists in the JGroups component of Apache Camel that can lead to remote code execution. This issue arises when the JGroupsEndpoint processes messages without adequate input filtering during the deserialization of objects. The default configuration allows any reachable host to send crafted serialized objects to the affected component, potentially exploiting the system if a suitable deserialization gadget chain is present. Users are urged to upgrade their versions to mitigate this risk, with specific upgrade paths provided for multiple version streams.

References