Severity:
CVSS 3.1: 5.9 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-pqc) 4.12.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-pqc) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-pqc) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-pqc) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-pqc) 4.23.0 unaffected
Description:
Concurrent Execution using Shared Resource with Improper Synchronization ('Race
Condition') vulnerability in Apache Camel PQC component.
This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before
4.22.1.
The producer held a single java.security.Signature instance and used it for
every exchange without synchronizing access. Signature is stateful and is not
thread safe: update() accumulates the data to be signed or verified, and
verify() consumes that accumulated state. With concurrent exchanges sharing one
instance the update and verify calls of different messages interleave, so a
verification can complete against data that belongs to another exchange, or
against a partially accumulated buffer. The outcome is non-deterministic and
includes a verification reporting success for a message whose signature was
never actually checked, which defeats the guarantee the component exists to
provide. Reaching it requires concurrent traffic through the same endpoint,
which is the ordinary condition for a Camel route under load.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The Signature instance is no longer shared
across concurrent exchanges. For deployments that cannot upgrade immediately,
restrict the affected route to a single concurrent consumer so that no two
exchanges use the instance at once.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The Signature instance is no longer shared
across concurrent exchanges.
Work Arounds:
For deployments that cannot upgrade immediately, restrict the affected route to
a single concurrent consumer so that no two exchanges use the instance at once.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-85248.html
https://issues.apache.org/jira/browse/CAMEL-24445
https://github.com/apache/camel/pull/25825
https://github.com/apache/camel/pull/25850
https://github.com/apache/camel/pull/25851
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-85248
