CVE-2015-5348: Apache Camel Remote Command Execution
Summary
CVE-2015-5348: Apache Camel can allow remote attackers to execute arbitrary commands. Affects org.apache.camel:camel-jetty across 2 version ranges.
< 2.15.5
>= 2.16.0, < 2.16.1
Fixed in 2.15.5 or 2.16.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies. The camel-jetty and camel-servlet components in Apache Camel are used as consumers in Camel routes to handle HTTP requests. These components are vulnerable to a remote command execution vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2015-5348, allows remote attackers to execute arbitrary commands by exploiting a flaw in the handling of serialized Java objects in HTTP requests. This vulnerability affects Apache Camel versions 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1. Attackers can craft a malicious serialized Java object and send it as part of an HTTP request, which, when processed by camel-jetty or camel-servlet, can lead to the execution of arbitrary commands on the target system. This can result in unauthorized access, data leakage, or further compromise of the affected system.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.15.52.15.5 -
>= 2.16.0, < 2.16.12.16.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable or restrict access to the camel-jetty and camel-servlet components in Camel routes. This can be achieved by modifying the configuration or removing the affected components from the routes. However, this workaround may impact the functionality of the application, and it is recommended to apply the official fix by upgrading to the patched version as soon as possible.
Conclusion
The Apache Camel remote command execution vulnerability (CVE-2015-5348) allows remote attackers to execute arbitrary commands on systems using camel-jetty or camel-servlet components in Camel routes. To mitigate the risk, it is crucial to upgrade to the patched version of Apache Camel as soon as possible. Restricting access to the vulnerable components or removing them from the routes can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-jetty →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It enables developers to integrate different systems using various protocols and technologies.
Apache Camel versions 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1 are affected by this vulnerability.
An attacker can exploit this vulnerability by crafting a serialized Java object and sending it as part of an HTTP request to a system using camel-jetty or camel-servlet components in Camel routes. When the request is processed, the malicious object can trigger the execution of arbitrary commands on the target system.
Exploiting this vulnerability can lead to unauthorized access, data leakage, or further compromise of the affected system. Attackers can execute arbitrary commands, potentially gaining control over the system and performing malicious activities.
To mitigate the risk, it is recommended to upgrade to the patched version of Apache Camel (2.15.5 or later for versions 2.15.x and 2.16.1 or later for versions 2.16.x). Additionally, restricting access to the vulnerable components or removing them from the routes can serve as a temporary workaround until the upgrade is applied.
