VULNERABILITY INTELLIGENCE
CVE-2020-11973
CVSS score9.8 CRITICAL
EPSS probability6.76%
CISA KEVNot currently listed
Published2020-05-14
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Weakness classification
- nvd@nist.gov: CWE-502
Primary references
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Vendor Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory