Apache Camel fixes 38 CVEs in 4.18.5, 4.22.1 and 4.23.0
Original title: Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0
The 4.14.x line is end of life and does not receive these fixes.
On October 15, the Apache Camel PMC published 38 security advisories, Andrea Cosentino reported to oss-security on October 18. All of the issues are fixed in Apache Camel 4.18.5, 4.22.1 and 4.23.0, and the project recommends upgrading. The 4.14.x line is end of life and does not get the fixes. The visible list begins with an incomplete Camel-Hazelcast fix for CVE-2026-43865 and medium-severity unsafe Java deserialization CVE-2026-78162.
Unconfirmed: The snippet lists only the start of the 38 advisories, so most CVE details are absent.
- Users still on 4.14.x or older are asked to move to a supported release.
- Camel-Hazelcast has an incomplete fix for CVE-2026-43865.
- CVE-2026-78162 is rated MEDIUM and involves unsafe Java deserialization.
Impact: Unsafe Java deserialization; 38 Camel issues fixed
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel | 4.14.x and older do not receive the fixes | 4.18.5, 4.22.1 and 4.23.0 |
| Apache Camel-Hazelcast | — | — |
- 1.Upgrade Apache Camel to 4.18.5, 4.22.1, or 4.23.0.
- 2.Move off end-of-life 4.14.x or older to a supported release.
- Vendors
- Apache
- Products
- Apache CamelCamel-Hazelcast
- Organizations
- Apache Camel PMC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-43865 | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component | 8.1 | <1% | ||
| CVE-2026-78162 | Unrestricted Java deserialization RCE in Apache Camel Hazelcast | 10.0 | <1% | PoC |
From the original article
Posted by Andrea Cosentino on Oct 18 On 15 October the Apache Camel PMC published 38 security advisories. All of the issues are fixed in Apache Camel 4. 18.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.