GHSA-5rc6-9qfp-8vwg

Suggest an improvement
Source
https://github.com/advisories/GHSA-5rc6-9qfp-8vwg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5rc6-9qfp-8vwg/GHSA-5rc6-9qfp-8vwg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5rc6-9qfp-8vwg
Aliases
  • CVE-2026-27172
Published
2026-04-27T12:30:38Z
Modified
2026-05-05T22:09:10.681645Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data
Details

The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject() without configuring an ObjectInputFilter. An attacker who can write to the Consul KV store backing a Camel ConsulRegistry instance could inject a malicious serialized Java object that is deserialized the next time Camel performs a lookup against that registry, leading to arbitrary code execution in the Camel process. The issue mirrors the class of vulnerability already addressed for other Camel components in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747, and was overlooked during the original remediation of those CVEs.

This issue affects Apache Camel: from 3.0.0 before 4.14.6, from 4.15.0 before 4.18.1.

Users are recommended to upgrade to version 4.19.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.6. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.1.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:43:47Z",
    "nvd_published_at": "2026-04-27T11:16:01Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.apache.camel:camel-consul

Package

Name
org.apache.camel:camel-consul
View open source insights on deps.dev
Purl
pkg:maven/org.apache.camel/camel-consul

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
4.14.6

Affected versions

3.*
3.0.0
3.0.1
3.1.0
3.2.0
3.3.0
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.5.0
3.6.0
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.7.6
3.7.7
3.8.0
3.9.0
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.5
3.11.6
3.11.7
3.12.0
3.13.0
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.14.5
3.14.6
3.14.7
3.14.8
3.14.9
3.14.10
3.15.0
3.16.0
3.17.0
3.18.0
3.18.1
3.18.2
3.18.3
3.18.4
3.18.5
3.18.6
3.18.7
3.18.8
3.19.0
3.20.0
3.20.1
3.20.2
3.20.3
3.20.4
3.20.5
3.20.6
3.20.7
3.20.8
3.20.9
3.21.0
3.21.1
3.21.2
3.21.3
3.21.4
3.21.5
3.22.0
3.22.1
3.22.2
3.22.3
3.22.4
4.*
4.0.0-M1
4.0.0-M2
4.0.0-M3
4.0.0-RC1
4.0.0-RC2
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.1.0
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.5.0
4.6.0
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.9.0
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.11.0
4.12.0
4.13.0
4.14.0
4.14.1
4.14.2
4.14.3
4.14.4
4.14.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5rc6-9qfp-8vwg/GHSA-5rc6-9qfp-8vwg.json"

Maven / org.apache.camel:camel-consul

Package

Name
org.apache.camel:camel-consul
View open source insights on deps.dev
Purl
pkg:maven/org.apache.camel/camel-consul

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.18.1

Affected versions

4.*
4.15.0
4.16.0
4.17.0
4.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-5rc6-9qfp-8vwg/GHSA-5rc6-9qfp-8vwg.json"