{"metadata": {"vulnerability": "CVE-2026-78165", "count": 26, "kinds": {"milestone": 5, "sighting": 6, "kev": 0, "other": 15}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-23T12:53:32.309Z", "date_only": false, "value": "2026-08-23T12:53:32.309Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-78165", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "vulnerabilities.3.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-16T13:00:08Z", "date_only": false, "value": "2026-10-16T13:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105550", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "c09ad61b-8dc9-448a-a0f6-24a7503af846", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-78165\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-16 11:18:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) \u2014 Camel Spring Boot + Camel Quarkus\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105550", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-16T15:00:16Z", "date_only": false, "value": "2026-10-16T15:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/oa5k6kBfthQUe5_2xq482d0JhIx-P9f36xq_0Zd47RbfMV0", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "044bdf2d-7b8a-4d24-b2a0-a0e93410b2d4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-16T15:00:16Z", "date_only": false, "value": "2026-10-16T15:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/oa5k6kBfthQUe5_2xq482d0JhIx-P9f36xq_0Zd47RbfMV0", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "7369c613-e739-487a-8ae3-85fb9309f279"}, {"timestamp": "2026-10-16T21:00:04Z", "date_only": false, "value": "2026-10-16T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZvP9L6ePYT9vhXxhadalh4A4elfP-EiiV55yjx_8GwciiB8", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "2a3694ad-6444-47d5-9680-d987dd90e278", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-16T21:00:04Z", "date_only": false, "value": "2026-10-16T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ZvP9L6ePYT9vhXxhadalh4A4elfP-EiiV55yjx_8GwciiB8", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "604b5dfd-4f4c-46be-bcf4-60cdcc6c5842"}, {"timestamp": "2026-10-19T10:08:06.783Z", "date_only": false, "value": "2026-10-19T10:08:06.783Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-78165", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T10:08:17.232Z", "date_only": false, "value": "2026-10-19T10:08:17.232Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-78165", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:23:21.249Z", "date_only": false, "value": "2026-10-19T10:23:21.249514Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117467080333234494", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "b301e0ac-6313-41ab-bf14-14360dd127e6", "content": "CVE-2026-78165 Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.\nThis issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\nRedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and that instance was used for every read the component performs. Spring's implementation delegates through DeserializingConverter to DefaultDeserializer, which reads the bytes with a ConfigurableObjectInputStream and installs no java.io.ObjectInputFilter on the stream, so an arbitrary serialized class graph was materialised and its readObject method executed. RedisConsumer.setBody applied that serializer to the raw bytes of every message published to the subscribed channels, before the Exchange was constructed and therefore before any route logic could inspect the message, so an actor able to issue PUBLISH on a subscribed channel reached the deserialization sink directly. The same default serializer backed the RedisTemplate built by RedisConfiguration.createDefaultTemplate, so the producer read commands GET, HGET, HGETALL and HVALS deserialized whatever was stored in the Redis keyspace, and SpringRedisIdempotentRepository shared that template. Configuring a custom redisTemplate did not close the consumer path, because RedisConsumer.setBody reads getSerializer directly rather than the serializer attached to the template, so a deployment that had wired a String serializer into its own template remained exposed on the consumer side unless it also set the serializer option. The component never constructed a java.io.ObjectInputStream itself, which is why earlier passes over the Camel codebase for unfiltered Java deserialization did not reach it. The behaviour dates back to the introduction of the component, first released in 2.11.0, and was unchanged until this fix.\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, set the JVM-wide jdk.serialFilter system property, which the affected code path honours because it reads through a java.io.ObjectInputStream, for example -Djdk.serialFilter=!java.net.**;java.**;javax.**;org.apache.camel.**;!* ; or set the serializer endpoint option to a serializer that does not use Java serialization, such as StringRedisSerializer, noting that this must be set as the serializer option and not only on a custom redisTemplate. As defence in depth, require authentication on the Redis instance and restrict which clients may publish to the subscribed channels, and do not expose a Redis instance consumed by Camel to untrusted networks.\nhttps://www.cve.org/CVERecord?id=CVE-2026-78165https://camel.apache.org/security/CVE-2026-78165.htmlhttps://issues.apache.org/jira/browse/CAMEL-24421https://github.com/apache/camel/pull/25587https://github.com/apache/camel/pull/25588https://github.com/apache/camel/pull/25589https://github.com/apache/camel/pull/25734#apache #ApacheSoftwareFoundation #ApacheCamel#CVE_2026_78165#bot", "url": "https://infosec.exchange/users/cve/statuses/117467080333234494"}, {"timestamp": "2026-10-19T11:17:19Z", "date_only": false, "value": "2026-10-19T11:17:19Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8P5R-XPXR-X2X7", "record": "GHSA-8P5R-XPXR-X2X7", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-19T11:17:19.643Z", "date_only": false, "value": "2026-10-19T11:17:19.643", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-78165", "record": "FKIE_CVE-2026-78165", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-19T12:32:49Z", "date_only": false, "value": "2026-10-19T12:32:49Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8P5R-XPXR-X2X7", "record": "GHSA-8P5R-XPXR-X2X7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-19T22:00:00Z", "date_only": false, "value": "2026-10-19T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-20T03:55:35.397Z", "date_only": false, "value": "2026-10-20T03:55:35.397588Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-78165", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T03:55:35.397Z", "date_only": false, "value": "2026-10-20T03:55:35.397588Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-78165", "record": "FKIE_CVE-2026-78165", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-20T13:08:03.518Z", "date_only": false, "value": "2026-10-20T13:08:03.518Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-78165", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T13:08:03.518Z", "date_only": false, "value": "2026-10-20T13:08:03.518Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-78165", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T14:17:01.450Z", "date_only": false, "value": "2026-10-20T14:17:01.450", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-78165", "record": "FKIE_CVE-2026-78165", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-20T15:31:17Z", "date_only": false, "value": "2026-10-20T15:31:17Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8P5R-XPXR-X2X7", "record": "GHSA-8P5R-XPXR-X2X7", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-11T12:58:12.451Z", "date_only": false, "value": "2026-11-11T12:58:12.451+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-13T01:22:52.184Z", "anchors": {"origin": {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-10-16T13:00:08Z", "date_only": false, "value": "2026-10-16T13:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105550", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "c09ad61b-8dc9-448a-a0f6-24a7503af846", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-78165\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-16 11:18:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) \u2014 Camel Spring Boot + Camel Quarkus\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105550", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 54008.0, "hours": 15.002222222222223, "days": 0.6250925925925926, "min_seconds": 54008.0, "max_seconds": 54008.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-10-16T13:00:08Z", "date_only": false, "value": "2026-10-16T13:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105550", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "c09ad61b-8dc9-448a-a0f6-24a7503af846", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-78165\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-16 11:18:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) \u2014 Camel Spring Boot + Camel Quarkus\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105550", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2431372.18491, "hours": 675.381162475, "days": 28.140881769791665, "min_seconds": 2431372.18491, "max_seconds": 2431372.18491, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-15T22:00:00Z", "date_only": false, "value": "2026-10-15T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4006", "record": "WID-SEC-W-2026-4006", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-13T01:22:52.184Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 2377364.18491, "hours": 660.3789402527777, "days": 27.51578917719907, "min_seconds": 2377364.18491, "max_seconds": 2377364.18491, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-16T13:00:08Z", "date_only": false, "value": "2026-10-16T13:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105550", "record": "CVE-2026-78165", "field": "creation_timestamp", "uuid": "c09ad61b-8dc9-448a-a0f6-24a7503af846", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-78165\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a oscerd\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-16 11:18:49\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads with no ObjectInputFilter (RCE) \u2014 Camel Spring Boot + Camel Quarkus\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105550", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-13T01:22:52.184Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}