CVE-2016-8749: Apache Camel's Jackson and JacksonXML Remote Code Execution Vulnerability
Summary
CVE-2016-8749: Apache Camel's camel-jackson and camel-jacksonxml components are vulnerable to Java object de-serialisation vulnerability. Affects org.apache.camel:camel-jackson across 3 version ranges.
< 2.16.5
>= 2.17.0, < 2.17.5
>= 2.18.0, < 2.18.2
Fixed in 2.16.5, 2.17.5 or 2.18.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies. The 'camel-jackson' package is a component of Apache Camel that provides support for data transformation using the Jackson library. Jackson is a popular JSON library for Java that allows for easy serialization and deserialization of Java objects to JSON and vice versa. However, versions of Apache Camel's 'camel-jackson' package prior to 2.16.5, 2.17.5, and 2.18.2 are vulnerable to a remote code execution attack when performing unmarshalling operations with Jackson and JacksonXML.
Vulnerability Detail
The vulnerability in Apache Camel's 'camel-jackson' package arises from a lack of proper input validation during the unmarshalling process. An attacker can exploit this vulnerability by crafting a malicious JSON or XML payload that, when processed by the application, triggers the execution of arbitrary code. This can lead to unauthorized access, data leakage, or complete compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.16.52.16.5 -
>= 2.17.0, < 2.17.52.17.5 -
>= 2.18.0, < 2.18.22.18.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable the use of unmarshalling operations with Jackson and JacksonXML in their Apache Camel applications. This can be achieved by configuring the application to use alternative data transformation libraries or by avoiding the use of unmarshalling operations altogether. However, this workaround may impact the functionality of the application and is not a permanent solution.
Conclusion
Apache Camel's 'camel-jackson' package is vulnerable to remote code execution attacks when performing unmarshalling operations with Jackson and JacksonXML. It is crucial to upgrade to a fixed version of the package and regularly update all dependencies to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-jackson →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and technologies.
The 'camel-jackson' package is a component of Apache Camel that provides support for data transformation using the Jackson library. Jackson is a popular JSON library for Java that allows for easy serialization and deserialization of Java objects to JSON and vice versa.
This vulnerability allows remote code execution, which can lead to unauthorized access, data leakage, or complete compromise of the affected system.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, it is recommended to upgrade to a fixed version of the 'camel-jackson' package. Versions 2.16.5, 2.17.5, and 2.18.2 or later have addressed this issue.
