CVE-2026-6857

Summary

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

Affected Software

Weaknesses

• CWE-502: Deserialization of Untrusted Data

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization

Additional References

• https://access.redhat.com/security/cve/CVE-2026-6857
• https://bugzilla.redhat.com/show_bug.cgi?id=2460003
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6857.json
• https://access.redhat.com/errata/RHSA-2026:22453
• https://access.redhat.com/errata/RHSA-2026:17668

References

• https://access.redhat.com/errata/RHSA-2026:17668
• https://access.redhat.com/errata/RHSA-2026:22453
• https://access.redhat.com/security/cve/CVE-2026-6857
• https://bugzilla.redhat.com/show_bug.cgi?id=2460003

• ←Previous
• Next→