Loading...
Skip to main content
GeekWala

CVE-2017-12633 — Vulnerability in org.apache.camel:camel-hessian —...

CRITICAL

Apache Camel camel-hessian component vulnerable to Java object deserialization

Published May 14, 2022Updated November 8, 2023Source: osv

Summary

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

Advisory Timeline

  • First published May 14, 2022 (1612 days ago).
  • Last revised November 8, 2023 — 543 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.apache.camel:camel-hessian to 2.19.4 or later
<!-- Update pom.xml dependency version to 2.19.4 for org.apache.camel:camel-hessian -->
Maven
Update org.apache.camel:camel-hessian to 2.20.1 or later
<!-- Update pom.xml dependency version to 2.20.1 for org.apache.camel:camel-hessian -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.apache.camel:camel-hessian
maven
2.17.0, 2.17.1, 2.17.2, 2.17.3 (+14 more)2.19.4
org.apache.camel:camel-hessian
maven
2.20.02.20.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-502
    Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2017-12633?
Apache Camel camel-hessian component vulnerable to Java object deserialization This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2017-12633?
CVE-2017-12633 affects org.apache.camel:camel-hessian. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2017-12633 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-5whj-523x-6j68

Related CVEs

  • CVE-2026-40453
    CRITICAL

    Apache Camel has an incomplete fix for CVE-2025-27636

  • CVE-2026-40860
    CRITICAL

    Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

  • CVE-2026-40022
    HIGH

    Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

  • CVE-2026-40859
    HIGH

    Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

  • CVE-2026-42527
    HIGH

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

  • CVE-2026-43866
    HIGH

    Apache Camel JMS deserialization filter bypass

  • CVE-2026-46592
    HIGH

    Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

  • CVE-2026-43865
    HIGH

    Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies