CVE-2026-85248: Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.
This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.
The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.18.5 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.22.1 - Compensating control
For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the shared signature instance at once.
Event History
Frequently Asked Questions
Which Apache Camel versions are affected?
Affected versions are Apache Camel 4.12.0 through versions before 4.18.5, and 4.19.0 through versions before 4.22.1. The issue is fixed in 4.18.5 for the 4.18.x LTS stream, 4.22.1 for the 4.22.x LTS stream, and 4.23.0.
What conditions are required to exploit this issue?
An attacker does not need authentication or user interaction, but concurrent traffic must pass through the same affected PQC endpoint. This is described as an ordinary condition for a Camel route under load, because concurrent exchanges can share the producer's unsynchronized Signature instance.
What is the security impact of a successful race?
Interleaved update and verify operations can cause verification to use data from a different exchange or a partially accumulated buffer. In some non-deterministic cases, verification can report success even though that message's signature was never actually checked, resulting in an integrity impact.
What should teams do if they operate an affected version?
Upgrade to Apache Camel 4.23.0, or to 4.18.5 or 4.22.1 when remaining on the corresponding LTS release stream. The provided information does not specify a workaround for systems that cannot be upgraded immediately.