CVE-2026-25747: Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB
Deserialization of Untrusted Data vulnerability in Apache Camel LevelDB component.
The Camel-LevelDB DefaultLevelDBSerializer class deserializes data read from the LevelDB aggregation repository using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. An attacker who can write to the LevelDB database files used by a Camel application can inject a crafted serialized Java object that, when deserialized during normal aggregation repository operations, results in arbitrary code execution in the context of the application. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, from 4.15.0 before 4.18.0.
Users are recommended to upgrade to version 4.18.0, which fixes the issue. For the 4.10.x LTS releases, users are recommended to upgrade to 4.10.9, while for 4.14.x LTS releases, users are recommended to upgrade to 4.14.5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.camel:camel-leveldbto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
maven/org.apache.camel:camel-leveldbto a version that resolves this vulnerability.Fixed in 4.14.5 - Upgrade
Upgrade
maven/org.apache.camel:camel-leveldbto a version that resolves this vulnerability.Fixed in 4.10.9 - Upgrade
Upgrade
Apache Camel LevelDBto a version that resolves this vulnerability.Fixed in 4.10.9 - Upgrade
Upgrade
Apache Camel LevelDBto a version that resolves this vulnerability.Fixed in 4.14.5 - Upgrade
Upgrade
Apache Camel LevelDBto a version that resolves this vulnerability.Fixed in 4.18.0 - Compensating control
Ensure an attacker cannot write to the LevelDB database files used by the Camel application (e.g., restrict filesystem permissions/ownership and access to the LevelDB aggregation repository data so only the application can write).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25747?
CVE-2026-25747 has been classified with a high severity due to its potential for remote code execution through unsafe deserialization.
How do I fix CVE-2026-25747?
To fix CVE-2026-25747, upgrade to Apache Camel LevelDB versions 4.10.9, 4.14.5, or 4.18.0.
What components are affected by CVE-2026-25747?
CVE-2026-25747 affects the Apache Camel LevelDB component, specifically the DefaultLevelDBSerializer class.
What type of vulnerability is CVE-2026-25747?
CVE-2026-25747 is an instance of deserialization of untrusted data.
Is CVE-2026-25747 easy to exploit?
Yes, CVE-2026-25747 can be easily exploited if untrusted data is deserialized without proper validation.