CVE-2026-43865 camel vulnerability
Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean is provided - neither Hazelcast's JavaSerializationFilterConfig nor a Camel-side ObjectInputFilter is configured, so objects received over the Hazelcast cluster protocol are deserialized inside Hazelcast's own serialization layer (ObjectInputStream.readObject) before Camel ever processes them. An attacker who can join or otherwise reach the Hazelcast cluster can publish a crafted serialized Java object that is then deserialized on every Camel node, resulting in remote code execution. The exposure is present by default and requires no opt-in endpoint configuration: any route using a hazelcast consumer (hazelcast-topic, hazelcast-queue, hazelcast-seda, hazelcast-map, hazelcast-multimap, hazelcast-replicatedmap, hazelcast-list, hazelcast-set), as well as the HazelcastAggregationRepository and HazelcastIdempotentRepository, is affected whenever the managed instance is created from Camel's default configuration. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix makes Camel apply a default Hazelcast JavaSerializationFilterConfig (whitelisting the java., javax. and org.apache.camel. class-name prefixes and blacklisting java.net.) to instances it creates from its own default configuration, while leaving any user-supplied Config or HazelcastInstance untouched. For deployments that cannot upgrade immediately, configure a deserialization filter on the Hazelcast instance (Hazelcast JavaSerializationFilterConfig, or the JVM-wide system property -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!*) and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster.
Quick answer
apache camel should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Review vendor advisory for affected versions.
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
CVE-2026-43865 affects Apache Camel Hazelcast. Upgrade Apache Camel on the deployed branch to 4.14.8, 4.18.3, 4.21.0 and review any route that exposes this component to user-controlled messages, headers, files, or backend responses. Affected ranges in the local record are 4.0.0 through before 4.14.8; 4.15.0 through before 4.18.3; 4.19.0 through before 4.21.0.
- Inventory every service, route, integration runtime, container image, and dependency lockfile that includes Apache Camel Hazelcast or related Camel modules.
- Compare deployed Camel versions with the affected ranges for CVE-2026-43865; prioritize internet-facing routes, message brokers, file parsers, and integrations that process untrusted input.
- Upgrade to 4.14.8, 4.18.3, 4.21.0, or to a later vendor-supported Camel release on the same branch.
- Rebuild application artifacts and container images from a clean dependency lockfile so vulnerable Camel modules are removed from direct and transitive dependencies.
- Harden route boundaries by filtering user-controlled Camel headers, component control headers, serialized objects, command arguments, paths, and backend response bodies before they reach Camel internals.
- Rotate credentials, tokens, queue secrets, and integration keys if the affected route could expose data, redirect backend requests, deserialize attacker-controlled objects, or execute unintended operations.
- Deploy first to staging, run regression tests for the impacted route, then promote to production with monitoring for route errors, deserialization events, SSRF indicators, unexpected command arguments, and authorization failures.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm dependency output shows Apache Camel 4.14.8, 4.18.3, 4.21.0 or a later fixed release in every affected application.
- Replay malicious or unexpected headers, serialized payloads, paths, files, command arguments, and backend responses against the affected route and verify they are rejected or sanitized.
- Check application logs after deployment for exceptions, leaked stack traces, SSRF attempts, command execution anomalies, unauthorized backend operations, or unexpected route destinations.
- Open the generated Fixnx page and confirm the canonical URL ends with camel-cve-2026-43865.
- Re-run sitemap validation and confirm camel-cve-2026-43865 appears once in sitemap.xml with the full CVE-2026-43865 suffix.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-43865?
apache camel should be checked against the vendor advisory and trusted references linked on this page.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.