EUVD-2026-24738
GHSA-xfxp-ppx7-cqrp
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
5Blast Radius
ecosystem impact- 10 maven packages depend on org.apache.camel:camel-infinispan (2 direct, 8 indirect)
Ecosystem-wide dependent count for version 4.20.0.
DescriptionCVE.org
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
AnalysisAI
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary code via unsafe deserialization in ProtoStream remote aggregation repository. Exploiting this vulnerability requires network access and low-privilege credentials but grants full system compromise affecting confidentiality, integrity, and availability. The attack complexity is rated high (AC:H), suggesting specific configuration or timing requirements. No active exploitation confirmed at time of analysis (not in CISA KEV), and public exploit code status is unknown.
Technical ContextAI
The vulnerability resides in camel-infinispan, an Apache Camel component that integrates with Red Hat Data Grid (Infinispan) for distributed caching and data grid operations. ProtoStream is Infinispan's serialization library used for encoding/decoding Java objects in remote cache operations. The flaw is rooted in CWE-502 (Deserialization of Untrusted Data), where the remote aggregation repository accepts and deserializes attacker-controlled data without proper validation. When malicious serialized objects are processed, they can instantiate arbitrary classes and execute methods during deserialization, bypassing normal security controls. This affects multiple Red Hat middleware products: Apache Camel 4 for Quarkus 3, Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 8, and JBoss EAP Expansion Pack, all of which embed the vulnerable camel-infinispan component.
RemediationAI
Vendor-released patch status cannot be confirmed from available data; consult Red Hat Product Security advisory at https://access.redhat.com/security/cve/CVE-2026-6857 for update availability and exact fixed versions. Until patches are applied, implement these compensating controls: Disable or restrict access to ProtoStream remote aggregation repository features in camel-infinispan configurations if not operationally required (eliminates attack surface but may impact distributed aggregation capabilities). Enforce strict authentication and network segmentation to ensure only highly trusted users and systems can access Infinispan remote cache services (reduces PR:L to effective PR:H but requires infrastructure changes). Deploy input validation or allowlisting for serialized objects at network boundaries before they reach deserialization code (complex to implement correctly and may break legitimate remote cache operations). Monitor Infinispan and Camel logs for suspicious remote aggregation requests with unusual serialized payloads (detection-focused, does not prevent exploitation). Isolate affected middleware in network zones with strict egress filtering to limit post-exploitation lateral movement (containment strategy that reduces blast radius but does not prevent initial compromise).
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted ima
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers e
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned a
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the sec
Remote unauthenticated attackers can exhaust memory in Netty-based services that parse PROXY protocol v2, due to a refer
Same weakness CWE-502 – Deserialization of Untrusted Data
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today