Is CVE-2026-78165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78165 being exploited in the wild.

How severe is CVE-2026-78165?

High severity, with a CVSS score of 8.8, published 19 October 2026.

Which products and versions are affected?

Apache Camel 2.11.0 to 4.18.4, 4.19.0 to 4.22.0.

How is CVE-2026-78165 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78165?

Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78165: Apache Camel Spring Redis deserialization of untrusted data

CVE-2026-78165 · Severity: high · CVSS 8.8 · Published 2026-10-19

Apache Camel's Spring Redis component automatically deserializes data received from Redis channels without validation, allowing attackers who can publish to Redis to execute arbitrary code on the Camel application. This affects integrations that consume messages from Redis and process them in Camel routes. An attacker with access to publish to Redis can trigger remote code execution through malicious serialized objects.

Technologies: Apache Camel. Vendors: Apache.

Quick answers

Is CVE-2026-78165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78165 being exploited in the wild.
How severe is CVE-2026-78165?: High severity, with a CVSS score of 8.8, published 19 October 2026.
Which products and versions are affected?: Apache Camel 2.11.0 to 4.18.4, 4.19.0 to 4.22.0.
Is there a fix for CVE-2026-78165?: Yes: fixed in 4.23.0, 4.22.1, 4.18.5. Until then: Set the JVM-wide jdk.serialFilter system property (e.g. -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*), or configure the serializer endpoint option to use a non-Java serialization mechanism such as StringRedisSerializer. Additionally, require authentication on the Redis instance and restrict publish permissions on subscribed channels to prevent untrusted actors from reaching the deserialization sink. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78165 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78165?: Check whether you run Apache Camel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.23.0, 4.22.1, 4.18.5

Set the JVM-wide jdk.serialFilter system property (e.g. -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*), or configure the serializer endpoint option to use a non-Java serialization mechanism such as StringRedisSerializer. Additionally, require authentication on the Redis instance and restrict publish permissions on subscribed channels to prevent untrusted actors from reaching the deserialization sink.

Technical details

The RedisConfiguration builds a bare JdkSerializationRedisSerializer by default with no ObjectInputFilter, and RedisConsumer.setBody applies it directly to incoming message bytes before route logic runs. The producer commands (GET, HGET, HGETALL, HVALS) and SpringRedisIdempotentRepository also deserialize without filtering. An attacker able to PUBLISH to a subscribed channel or write to the Redis keyspace reaches the deserialization sink directly via Spring's DeserializingConverter, which executes arbitrary readObject methods. A custom serializer on the template does not protect the consumer path.

Affected products

Apache Camel 2.11.0 to 4.18.4, 4.19.0 to 4.22.0

Timeline

2026-10-19: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.