Apache Camel up to 4.10.8/4.14.4/4.17.x LevelDB deserialization

Summaryinfo

A vulnerability classified as problematic has been found in Apache Camel up to 4.10.8/4.14.4/4.17.x. This issue affects some unknown processing of the component LevelDB. This manipulation causes deserialization. This vulnerability is handled as CVE-2026-25747. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Camel up to 4.10.8/4.14.4/4.17.x. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the component LevelDB. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component. The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0. Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2026-25747. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/27/2026).

Upgrading to version 4.10.9, 4.14.5 or 4.18.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0445). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Apache Camel

Productinfo

Vendor

• Apache

Name

• Camel

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.10.0
• 4.10.1
• 4.10.2
• 4.10.3
• 4.10.4
• 4.10.5
• 4.10.6
• 4.10.7
• 4.10.8
• 4.11
• 4.12
• 4.13
• 4.14
• 4.14.0
• 4.14.1
• 4.14.2
• 4.14.3
• 4.14.4
• 4.15
• 4.16
• 4.17

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion