{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85248", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-03T16:26:19.164Z", "datePublished": "2026-10-19T10:34:16.177Z", "dateUpdated": "2026-10-19T10:34:16.177Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-19T10:34:16.177Z"}, "title": "Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance", "problemTypes": [{"descriptions": [{"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization", "lang": "en", "cweId": "CWE-362", "type": "CWE"}]}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Camel", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.camel:camel-pqc", "packageURL": "pkg:maven/org.apache.camel/camel-pqc", "versions": [{"status": "affected", "version": "4.12.0", "lessThan": "4.18.5", "versionType": "maven"}, {"status": "affected", "version": "4.19.0", "lessThan": "4.22.1", "versionType": "maven"}, {"status": "unaffected", "version": "4.18.5", "versionType": "maven"}, {"status": "unaffected", "version": "4.22.1", "versionType": "maven"}, {"status": "unaffected", "version": "4.23.0", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.\n\nThis issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\nThe producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.<br><br>This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.</p><p><br>The producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.<br><br>Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.</p>"}]}], "references": [{"url": "https://camel.apache.org/security/CVE-2026-85248.html", "name": "Apache Camel Security Advisory - CVE-2026-85248", "tags": ["vendor-advisory"]}, {"url": "https://issues.apache.org/jira/browse/CAMEL-24445", "name": "CAMEL-24445", "tags": ["issue-tracking"]}, {"url": "https://github.com/apache/camel/pull/25825", "name": "Fix on main, released in 4.23.0 (commit 91d5bdac51182fda8515e5b200e8aa842ccd1bc6)", "tags": ["patch"]}, {"url": "https://github.com/apache/camel/pull/25850", "name": "Backport to camel-4.22.x, released in 4.22.1 (commit 936a851a2b92c29712a77080fa0935b361179f83)", "tags": ["patch"]}, {"url": "https://github.com/apache/camel/pull/25851", "name": "Backport to camel-4.18.x, released in 4.18.5 (commit 1466b0fdf5a6e9a8fd859893f9b245218f30ea17)", "tags": ["patch"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges.</p>"}]}], "credits": [{"lang": "en", "value": "Claude Security", "type": "finder"}, {"lang": "en", "value": "Andrea Cosentino", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.camel:camel-pqc", "packageURL": "pkg:maven/org.apache.camel/camel-pqc", "product": "Apache Camel", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.18.5", "status": "affected", "version": "4.12.0", "versionType": "maven"}, {"lessThan": "4.22.1", "status": "affected", "version": "4.19.0", "versionType": "maven"}, {"status": "unaffected", "version": "4.18.5", "versionType": "maven"}, {"status": "unaffected", "version": "4.22.1", "versionType": "maven"}, {"status": "unaffected", "version": "4.23.0", "versionType": "maven"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.\n\nThis issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\nThe producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once."}], "id": "CVE-2026-85248", "lastModified": "2026-10-19T11:17:22.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@apache.org", "type": "Secondary"}]}, "published": "2026-10-19T11:17:22.970", "references": [{"source": "security@apache.org", "url": "https://camel.apache.org/security/CVE-2026-85248.html"}, {"source": "security@apache.org", "url": "https://github.com/apache/camel/pull/25825"}, {"source": "security@apache.org", "url": "https://github.com/apache/camel/pull/25850"}, {"source": "security@apache.org", "url": "https://github.com/apache/camel/pull/25851"}, {"source": "security@apache.org", "url": "https://issues.apache.org/jira/browse/CAMEL-24445"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}