CVE-2026-25747: 
Java vulnerability analysis and mitigation

CVE-2026-25747 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Apache Camel LevelDB component (camel-leveldb). The DefaultLevelDBSerializer class deserializes data from the LevelDB aggregation repository using raw java.io.ObjectInputStream without any ObjectInputFilter or class-loading restrictions, enabling arbitrary code execution. Affected versions include Apache Camel 4.10.0 before 4.10.9, 4.14.0 before 4.14.5, and 4.15.0 before 4.18.0. The vulnerability was disclosed on February 18, 2026, by Andrea Cosentino and carries a CVSS v3.1 base score of 8.8 (High) (Apache Advisory, oss-security).

The root cause is the use of raw java.io.ObjectInputStream in the DefaultLevelDBSerializer.deserializeKey() and DefaultLevelDBSerializer.deserializeExchange() methods, which perform no class filtering or allowlisting (CWE-502). This contrasts with the previously patched Cassandra aggregation repository (CVE-2024-23114), which was fixed in Camel 4.4.0 by using ClassLoadingAwareObjectInputStream with a restrictive ObjectInputFilter (java.**;org.apache.camel.**;!*). An attacker who can write to the LevelDB database files — via a shared filesystem, compromised storage, or a separate file-write vulnerability — can inject a crafted serialized Java object (e.g., a ysoserial gadget chain using CommonsCollections or Spring gadgets). Deserialization is triggered automatically during application startup recovery, periodic aggregation scans, or any get() call on the repository (oss-security, PoC Repo).

Successful exploitation results in arbitrary code execution (RCE) in the context of the Camel application process, leading to complete compromise of confidentiality, integrity, and availability of the affected system. An attacker can exfiltrate sensitive data processed by Camel routes, modify or destroy aggregation state, install backdoors, or pivot laterally within the network using the application's credentials and network access. The impact is bounded by the privileges of the Camel application service account but can be severe in enterprise integration environments where Camel processes sensitive business data (Apache Advisory, PoC Repo).

A public proof-of-concept (PoC) repository is available at https://github.com/oscerd/CVE-2026-25747, authored by the vulnerability discoverer, which includes a full Spring Boot reproducer application and step-by-step exploitation instructions using ysoserial gadget chains. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.075% (low probability of near-term exploitation). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires write access to LevelDB database files and the presence of a suitable gadget library (e.g., commons-collections 3.x) on the classpath (PoC Repo, oss-security).

1. Reconnaissance: Identify Apache Camel applications using the camel-leveldb component for aggregation, running versions 4.10.0–4.10.8, 4.14.0–4.14.4, or 4.15.0–4.17.x. Check for the presence of gadget libraries (e.g., commons-collections-3.x) on the application classpath.
2. Gain write access to LevelDB files: Obtain write access to the LevelDB database directory used by the Camel application (e.g., /tmp/leveldb-exploit/aggregation.db) via a shared filesystem, misconfigured permissions, a separate file-write vulnerability, or compromised storage.
3. Generate malicious payload: Use ysoserial to generate a serialized Java gadget chain payload targeting an available gadget library:

   java -jar ysoserial-all.jar CommonsCollections7 "touch /tmp/pwned" | xxd -p | tr -d '\n' > payload.txt

4. Inject payload into LevelDB: Write the crafted serialized object directly into the LevelDB database under a key that will be read by the Camel aggregation repository (e.g., via the PoC's /exploit/inject REST endpoint or direct LevelDB file manipulation).
5. Trigger deserialization: Wait for or trigger one of the following deserialization paths: application restart (recovery of incomplete aggregations), periodic recovery scan, or a direct get() call on the repository key containing the malicious payload.
6. Verify RCE: Confirm code execution by checking for the side effect of the injected command (e.g., ls -la /tmp/pwned) or establishing a reverse shell (PoC Repo, oss-security).

• File System: Unexpected or modified files in the LevelDB database directory (e.g., /tmp/leveldb-exploit/ or application-configured LevelDB path); presence of ysoserial-generated payload artifacts; new files created by the Camel process in unexpected locations (e.g., /tmp/pwned).
• Process: Unusual child processes spawned by the Camel JVM process (e.g., /bin/bash, sh, curl, wget, python, nc); unexpected outbound network connections from the Camel application process.
• Logs: Java deserialization exceptions or ClassNotFoundException errors in Camel application logs during aggregation repository operations; unexpected ObjectInputStream stack traces in application logs; Camel route errors referencing DefaultLevelDBSerializer.
• Network: Outbound connections to unknown external IPs or C2 infrastructure originating from the Camel application server, particularly following application startup or aggregation recovery events.

Upgrade Apache Camel to a patched version: 4.18.0 (current releases), 4.10.9 (4.10.x LTS), or 4.14.5 (4.14.x LTS). As an interim workaround, restrict filesystem write access to LevelDB database directories so only the Camel application process can write to them, and remove or upgrade vulnerable gadget libraries (e.g., commons-collections 3.x) from the application classpath. Alternatively, configure the application to use JacksonLevelDBSerializer instead of the default DefaultLevelDBSerializer to avoid Java object deserialization entirely. Implement monitoring and alerting on unexpected modifications to LevelDB data directories (Apache Advisory, oss-security).

The vulnerability was discovered and reported by Apache Camel committer Andrea Cosentino, who also developed the remediation and published the PoC repository. The disclosure was made via the oss-security mailing list on February 18, 2026, and the Apache security advisory was published shortly after. Security news outlet SecurityOnline.info covered the vulnerability alongside a related Apache Camel Keycloak flaw. Community discussion on Bluesky and aggregation by threat intelligence platforms (VulDB, Qualys, CIRCL) indicates moderate industry awareness, though no major threat actor attribution or widespread alarm has been reported (oss-security, SecurityOnline).