CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-11972
Critical (9.8). EPSS 5.7% chance of exploitation in the next 30 days. Fixed in org.apache.camel:camel-rabbitmq 2.25.1, 3.2.0.
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Severity
- EPSS
- 5.7% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:camel
- oracle:communications_diameter_signaling_router
- oracle:enterprise_manager_base_platform
- oracle:flexcube_private_banking
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2x6r-7427-95cm | Maven | org.apache.camel:camel-rabbitmq | <2.25.1 | 2.25.1 |
| GHSA-2x6r-7427-95cm | Maven | org.apache.camel:camel-rabbitmq | >=3.0.0 <3.2.0 | 3.2.0 |