oscerd opened a new pull request, #1823: URL: https://github.com/apache/camel-website/pull/1823
Adds the security advisory page for CVE-2026-88900. Every release that carries the fix is already on Maven Central, so it can be published on its own, ahead of the advisories that wait for 4.22.2. | CVE | Component | Issue | Severity | Fix | | --- | --- | --- | --- | --- | | CVE-2026-88900 | Camel-JGroups | The jgroups consumer set the exchange body from `Message.getObject()`, which Java-deserializes cluster messages with no `ObjectInputFilter`, on a default UDP-multicast channel without authentication (CWE-502) | HIGH | [CAMEL-24676](https://issues.apache.org/jira/browse/CAMEL-24676), [CAMEL-25223](https://issues.apache.org/jira/browse/CAMEL-25223), [#26267](https://github.com/apache/camel/pull/26267), [#26281](https://github.com/apache/camel/pull/26281), [#26283](https://github.com/apache/camel/pull/26283), [#27205](https://github.com/apache/camel/pull/27205) | Fixed in 4.18.5, 4.22.1 and 4.23.0. The change in 4.18.5 and 4.22.1 is a class check on the already-deserialized body, so the advisory tells users on those lines to also set a JVM-wide `jdk.serialFilter` or secure the channel with AUTH and encryption. 4.23.0 refuses to start a consumer that has none of these controls. The `.md` ships with its matching clearsigned `.txt.asc`, signed with the key used for the existing advisories. The CVE record is submitted separately through the ASF CVE tool. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
