CVE-2026-78165

CVE-2026-78165 is an unsafe Java deserialization flaw in camel-spring-redis, the Apache Camel component for Redis through Spring Data. Apache published the advisory on 15 October 2026. The CVE record and NVD entry followed on 19 October.

When no serializer option is set, the component builds Spring's JDK serialization serializer. That serializer installs no deserialization filter.

The consumer applies it to every message on the subscribed channels, before any route logic runs. An actor who can publish to a subscribed channel reaches the sink directly. Apache says this allows remote code execution.

The same default also covers producer reads (GET, HGET, HGETALL, HVALS) and the Redis idempotent repository. Setting a custom template does not close the consumer path. Only the serializer option does.

The attacker needs the right to publish on the Redis instance. That is why Apache's score assumes low privileges. A Redis server without authentication lowers that bar.

Apache scores it CVSS 3.1 8.8 (High). NVD shows the Apache score and has not added its own.

Affected: 2.11.0 before 4.18.5, and 4.19.0 before 4.22.1. The behaviour dates back to the first release of the component. Fixed: 4.18.5, 4.22.1 and 4.23.0. The 4.14.x line is end of life.

The fix adds a default allow-list filter and a new deserializationFilter option. Before you can upgrade, Apache suggests a JVM-wide serialization filter, or a serializer that does not use Java serialization, set on the serializer option itself.

The advisory credits Leon Zlobecki. A public reproducer repository is published by Andrea Cosentino (oscerd), the Camel PMC member who wrote the fix. CISA's SSVC entry tags it as a PoC. ThreatWire did not run it and does not reprint its content.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23). No exploitation in the wild is reported.

Read the full explainer on the eight Camel and Camel K flaws. The JGroups flaw CVE-2026-88900 belongs to the same family.