Executive brief
Apache Camel is an integration framework used to connect different software applications. A security flaw in its LevelDB component allows an attacker who can modify the database files to execute malicious code on the server. This could lead to a full system takeover, data theft, or service disruption. Organizations using Camel with LevelDB for data persistence should update to the latest patched versions immediately.
Technical details
The vulnerability exists within the DefaultLevelDBSerializer class of the camel-leveldb component. It stems from the use of java.io.ObjectInputStream to deserialize data from the LevelDB aggregation repository without implementing ObjectInputFilter or class-loading restrictions. An attacker with the ability to write to the LevelDB database files can inject a malicious serialized Java object. When the application subsequently performs normal aggregation operations and deserializes this data, the payload is executed, leading to arbitrary code execution (RCE) in the context of the Java application. Patches are available in versions 4.10.9, 4.14.5, and 4.18.0.
Affected products
- Apache Software Foundation Camel LevelDB 3.0.0 to 4.10.8, 4.11.0 to 4.14.4, 4.15.0 to 4.17.9
Timeline
- 2026-02-18: disclosed: Initial disclosure on oss-security mailing list
- 2026-02-23: advisory: NVD and Vendor advisory published
References
- https://repo.maven.apache.org/maven2
- https://camel.apache.org/security/CVE-2026-25747.html
- https://github.com/oscerd/CVE-2026-25747
- http://www.openwall.com/lists/oss-security/2026/02/18/6
- https://access.redhat.com/security/cve/CVE-2026-25747
- https://bugzilla.redhat.com/show_bug.cgi?id=2441910
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25747.json