CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-11973
Critical (9.8). EPSS 6.8% chance of exploitation in the next 30 days. Fixed in org.apache.camel:camel-netty 3.2.0.
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Severity
- EPSS
- 6.8% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:camel
- oracle:communications_diameter_signaling_router
- oracle:enterprise_manager_base_platform
- oracle:flexcube_private_banking
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h79p-32mx-fjj9 | Maven | org.apache.camel:camel-netty | >=3.0.0 <3.2.0 | 3.2.0 |