Key points
- CVE-2026-78165 is rated CVSS 8.8 HIGH due to unfiltered Java deserialization.
- Affected versions include Apache Camel 2.11.0 through 4.18.4 and 4.19.0 through 4.22.0.
- Patches are available for versions 4.18.5, 4.22.1, and 4.23.0.
Apache Camel versions prior to 4.18.5 and 4.22.1 contain a high-severity deserialization flaw, according to the National Vulnerability Database. The issue, tracked as CVE-2026-78165, allows attackers to execute arbitrary code by sending malicious data to the Spring Redis component. Organizations using these versions should verify their deployment status immediately.
In plain English
The vulnerability exists because the component uses a default serializer that processes Java objects without filtering. When the system reads data from Redis, it trusts the incoming bytes completely. An attacker who can publish a message to a monitored channel can inject a harmful serialized object. The system then executes the code contained within that object before any security checks occur.
The background
This behavior dates back to the component’s introduction in version 2.11.0. The code lazily creates a bare serializer whenever no specific option is configured. This instance handles every read operation, including consumer messages and producer commands like GET or HGET. Even if users configured a custom template with a safe serializer, the consumer path remained exposed because it ignored those settings.
What changes now
The Apache Software Foundation has released fixes for supported release streams. Users on the 4.22.x line should upgrade to version 4.22.1, while those on 4.18.x should move to 4.18.5. Version 4.23.0 also contains the patch. Older lines, such as 4.14.x, have reached end of life and will not receive a fix, requiring a migration to a supported branch.
Who needs to act first
Security teams should prioritize systems that expose Redis instances to untrusted networks or accept data from external sources. Begin by updating the most exposed environments to the patched versions. If immediate upgrades are impossible, implement network restrictions to limit who can publish to subscribed channels. Ensure Redis authentication is enabled and verify that only authorized clients can interact with the service. Test changes in isolated environments before rolling them out broadly to avoid service disruptions.
What to do and how to stay safe: Apache Camel
- Upgrade Apache Camel to version 4.18.5, 4.22.1, or 4.23.0 to apply the vendor-provided fix.
- Set the JVM-wide jdk.serialFilter system property to restrict which classes can be deserialized if patching is delayed.
- Configure the serializer endpoint option to use a non-Java serialization method, such as StringRedisSerializer, ensuring it is set directly on the endpoint.
- Restrict network access to the Redis instance and enforce authentication to prevent unauthorized publishing to subscribed channels.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Camel versions are affected by CVE-2026-78165?
Versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1 are affected.
Is there a patch for Apache Camel 4.14.x?
No, the 4.14.x stream reached end of life and will not receive a fix for this issue.
Can I mitigate this by setting a custom redisTemplate?
No, configuring a custom redisTemplate does not close the consumer path; you must set the serializer endpoint option directly.
