CVE-2020-11973: Apache Camel Netty enables Java deserialization by default
Summary
CVE-2020-11973: Apache Camel Netty enables Java deserialization by default. Affects org.apache.camel:camel-netty versions >= 3.0.0, < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel Netty is a component of the Apache Camel integration framework that provides support for using Netty as a transport in Camel routes. Netty is a powerful and widely used Java framework for building high-performance network applications. However, Apache Camel Netty enables Java deserialization by default, which can lead to potential security vulnerabilities.
Vulnerability Detail
The vulnerability (CVE-2020-11973) in Apache Camel Netty allows for Java deserialization attacks. This means that an attacker can exploit the deserialization process to execute arbitrary code on the target system. The vulnerability affects Apache Camel versions 2.22.x, 2.23.x, 2.24.x, 2.25.0, and 3.0.0 up to 3.1.0. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-502.
How To Fix
Latest published version: 4.23.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to the latest secure versions of Apache Camel.
Conclusion
Apache Camel Netty enables Java deserialization by default, which can lead to potential security vulnerabilities. To mitigate this issue, it is crucial to upgrade to the latest secure versions of Apache Camel (2.25.1 for Apache Camel 2.x and 3.2.0 for Apache Camel 3.x). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-netty →
FAQ
Apache Camel Netty is a component of the Apache Camel integration framework that provides support for using Netty as a transport in Camel routes. Netty is a powerful and widely used Java framework for building high-performance network applications.
Java deserialization is the process of converting a serialized object back into its original form as a Java object. It is a fundamental feature of Java's object serialization mechanism.
The vulnerability allows for Java deserialization attacks, which can lead to arbitrary code execution on the target system. This can result in unauthorized access, data breaches, and compromise of the affected system.
The vulnerability affects Apache Camel versions 2.22.x, 2.23.x, 2.24.x, 2.25.0, and 3.0.0 up to 3.1.0.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
