CVE-2026-25747: Apache Camel LevelDB Component Deserialization Vulnerability
Summary
CVE-2026-25747: Apache Camel Deserializes Untrusted Data in its LevelDB Component. Affects org.apache.camel:camel-leveldb across 3 version ranges.
>= 3.0.0, < 4.10.9
>= 4.11.0, < 4.14.5
>= 4.15.0, < 4.18.0
Fixed in 4.10.9, 4.14.5 or 4.18.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that enables the integration of various applications using different protocols and data formats. The LevelDB component in Apache Camel is used for storing and retrieving data in a LevelDB database. This component is designed for high performance and scalability, making it a popular choice for applications that require efficient data handling. However, the LevelDB component has a critical vulnerability that allows for the deserialization of untrusted data, potentially leading to severe security risks.
Vulnerability Detail
The vulnerability arises from the DefaultLevelDBSerializer class in the Camel-LevelDB component, which deserializes data from the LevelDB aggregation repository using java.io.ObjectInputStream without implementing any ObjectInputFilter or class-loading restrictions. This flaw allows an attacker with write access to the LevelDB database files to inject a malicious serialized Java object. When this object is deserialized during normal operations, it can lead to arbitrary code execution within the application context, posing a significant security threat.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 4.10.94.10.9 -
>= 4.11.0, < 4.14.54.14.5 -
>= 4.15.0, < 4.18.04.18.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to restrict write access to the LevelDB database files to prevent unauthorized users from injecting malicious serialized objects. However, this does not fully mitigate the risk and upgrading to the patched version is strongly recommended.
Conclusion
The Apache Camel LevelDB component has a critical vulnerability (CVE-2026-25747) that allows for the deserialization of untrusted data, leading to potential arbitrary code execution. Users are urged to upgrade to the latest patched versions to mitigate this risk. For those unable to upgrade immediately, restricting write access to the database files is a temporary measure.
See every vulnerability recorded for org.apache.camel:camel-leveldb →
FAQ
CVE-2026-25747 is a vulnerability in the Apache Camel LevelDB component that allows for the deserialization of untrusted data, potentially leading to arbitrary code execution.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your pom.xml without any signup.
If exploited, this vulnerability can lead to arbitrary code execution within the application, allowing attackers to execute malicious code and potentially compromise the entire system.
The vulnerability affects Apache Camel versions from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.5, and from 4.15.0 before 4.18.0.
If immediate upgrading is not possible, restrict write access to the LevelDB database files as a temporary workaround, but plan to upgrade to a patched version as soon as possible.
