CVEvulnerability
CVE-2026-6857
7.5 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-04-22
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
Description
A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://access.redhat.com/errata/RHSA-2026:17668 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:22453 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-6857 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2460003 bugzilla.redhat.com
- https://access.redhat.com/errata/RHSA-2026:17668 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:22453 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-6857 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2460003 bugzilla.redhat.com
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6857.json security.access.redhat.com