7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6857

CVE-2026-6857: camel-infinispan Vulnerable to Deserialization of Untrusted Data

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6857

CVE-2026-6857:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.camel:camel-infinispan	maven	< 4.20.0	4.20.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch ec297f89065b6cfc2682487a96411692d6c296e2 reveals a classic insecure deserialization vulnerability. The patch modifies the deserialize method in the DefaultExchangeHolderUtils.java file. The core of the vulnerability lies in the unrestricted call to ois.readObject(). The patch mitigates this by introducing an ObjectInputFilter. This filter is applied to the ObjectInputStream before deserialization occurs. It checks for a JVM-wide serial filter and, if none is found, applies a default allowlist that only permits deserialization of safe, expected classes from java.**, javax.**, and org.apache.camel.** packages. This prevents an attacker from supplying a serialized object of a malicious type from an arbitrary package, which could otherwise be used to execute code on the server. Therefore, the function org.apache.camel.component.infinispan.remote.protostream.DefaultExchangeHolderUtils.deserialize is the exact location of the vulnerability.

Vulnerable functions

org.apache.camel.component.infinispan.remote.protostream.DefaultExchangeHolderUtils.deserialize

components/camel-infinispan/camel-infinispan/src/main/java/org/apache/camel/component/infinispan/remote/protostream/DefaultExchangeHolderUtils.java

The `deserialize` function in `DefaultExchangeHolderUtils` is vulnerable to untrusted data deserialization. Before the patch, it would read a Java object from a byte array using `ObjectInputStream.readObject()` without any validation or filtering of the object's type. This allows a remote attacker to craft a malicious serialized object that, when deserialized by the application, can lead to arbitrary code execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.