CVE-2026-78165 Apache Software Foundation CVE debrief

Who should care

Defenders and developers using Apache Camel Spring Redis component should assess exposure and prioritize remediation. This vulnerability requires verification of affected versions, inventory checks, and compensating controls.

Why it matters

CVE-2026-78165 is a high-severity vulnerability in Apache Camel Spring Redis component that allows deserialization of untrusted data, potentially leading to arbitrary code execution. Defenders and developers should assess exposure, prioritize remediation, and implement compensating controls.

• Verify affected Apache Camel versions and upgrade to fixed versions
• Implement jdk.serialFilter system property to restrict deserialization
• Configure custom serializer endpoint options to prevent arbitrary code execution
• Restrict publishing to subscribed Redis channels and require authentication

Technical summary

The Apache Camel Spring Redis component has a Deserialization of Untrusted Data vulnerability. This issue affects Apache Camel versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability allows an attacker to execute arbitrary code by deserializing untrusted data. The issue arises from RedisConfiguration.getSerializer lazily building a bare JdkSerializationRedisSerializer, which is used for every read the component performs. This leads to arbitrary serialized class graph materialization and execution of its readObject method. Users can mitigate this by setting the JVM-wide jdk.serialFilter system property or configuring a custom serializer endpoint option.

Defensive priority

High

Recommended defensive actions

• Upgrade to Apache Camel version 4.23.0 or later
• Set the JVM-wide jdk.serialFilter system property
• Configure a custom serializer endpoint option
• Require authentication on the Redis instance and restrict publishing to subscribed channels
• Verify affected Apache Camel versions and upgrade to fixed versions
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. The issue affects Apache Camel versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.