cve.bz

CVE-2015-5348

8.1 highEPSS 6.4%

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

Severity

CVSS 3.0

8.1 high
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
6.4% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE
CWE-19
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-jetty<2.15.52.15.5
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-jetty>=2.16.0 <2.16.12.16.1
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-servlet<2.15.52.15.5
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-servlet>=2.16.0 <2.16.12.16.1
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-http<2.15.52.15.5
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-http>=2.16.0 <2.16.12.16.1
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-http-common<2.15.52.15.5
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-http-common>=2.16.0 <2.16.12.16.1
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-http4<2.15.52.15.5
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-http4>=2.16.0 <2.16.12.16.1
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-ahc<2.15.52.15.5
GHSA-26v6-w6fw-rh94Mavenorg.apache.camel:camel-ahc>=2.16.0 <2.16.12.16.1

References

Check your stackJSON