CVE-2026-42527: camel 4.20.0; +1 more affected products

Affected technology

camel · from 4.14.0 (inclusive), before 4.14.8 (exclusive)
apache

camel · from 4.18.0 (inclusive), before 4.18.3 (exclusive)
apache

camel · 4.20.0
apache

Apache Camel · 4.14.0 to before 4.14.8, 4.15.0 to before 4.18.3, 4.19.0 to before 4.21.0
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

When an attacker can deliver a Java-serialized payload to an affected Camel consumer, deserialization of a HashMap (or any collection that calls hashCode on its elements) containing java.net.URL keys causes the JVM to issue DNS queries to the attacker-supplied host during the deserialization side-effect. Source advisory’s CVSS 3.1 assessment (base score 8.1/10) rates confidentiality, integrity and availability impact as high.