Log in Start free

Vulnerability · Published Apr 22, 2026 · Assigned by redhat

CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

High 7.5

In plain English

A high-severity unsafe deserialization in camel-infinispan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.camel:camel-infinispan4.20.0GHSA-xfxp-ppx7-cqrp

Affected products (as reported)

VendorProductVersions
camel-infinispan 4.0.0 – before 4.14.74.15.0 – before 4.18.24.19.0 – before 4.20.0
Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 see references
Red Hat Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References