Detections
Analytics

Chainguard: apache-camel-karavan-devmode: security update to 4.18.1-r10

high Tenable Cloud Security Plugin ID 478118

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern
 shipped with several Apache Camel components for defense-in-depth deserialization filtering
 ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository
 components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject methods
 perform network I/O, notably java.net.URL and java.net.InetAddress. When an attacker can deliver a Java-
 serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that
 calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the
 attacker-supplied host during the deserialization side-effect. The class-level filter check passes because
 the resulting object's class (HashMap) is allow-listed; the DNS query is observable on an attacker-
 controlled DNS server, providing an out-of-band side channel. The exposure is highest on the camel-jms
 family because JmsBinding.extractBodyFromJms invokes ObjectMessage.getObject() unconditionally when
 mapJmsMessage=true (default). Affected components: camel-jms, camel-sjms, camel-amqp, camel-mina, camel-
 netty, camel-netty-http, camel-vertx-http, camel-infinispan, and the aggregation repository components
 camel-leveldb, camel-cassandraql, camel-consul, camel-sql (JDBC aggregation repository). This issue
 affects Apache Camel: from 4.14.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0.
 Users are recommended to upgrade to a version that contains the CAMEL-23372 fix once available: 4.21.0 for
 the 4.21.x line, 4.18.3 for the 4.18.x line, and 4.14.8 for the 4.14.x line. For deployments that cannot
 upgrade immediately, configure a JMS-provider-side allow-list (Apache ActiveMQ Artemis
 'deserializationAllowList' / 'deserializationDenyList', Apache ActiveMQ Classic
 'org.apache.activemq.SERIALIZABLE_PACKAGES') as the primary mitigation, and/or override the in-code
 default via the endpoint-level 'deserializationFilter' option or the JVM-wide '-Djdk.serialFilter' system
 property with an explicit deny: '!java.net.**;java.**;javax.**;org.apache.camel.**;!*' (or
 '!java.net.**;java.**;org.apache.camel.**;!*' for the aggregation-repository components, which do not
 include javax.**). (CVE-2026-42527)

Solution

Update the apache-camel-karavan-devmode library and its related packages to version 4.18.1-r10 or later.

Plugin Details

Severity: High

ID: 478118

Version: Revision 1.1

Type: Local

Published: 10/31/2026

Updated: 10/31/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-42527

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/6/2026

Reference Information

CVE: CVE-2026-42527