{"id":"CVE-2026-85248","kind":"vulnerability","aliases":["CVE-2026-85248"],"related":[],"title":"Apache Camel PQC: shared Signature instance lets verification pass unchecked","description":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.\n\nThis issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\nThe producer held a single java.security.Signature instance and used it for every exchange without synchronizing access. Signature is stateful and is not thread safe: update() accumulates the data to be signed or verified, and verify() consumes that accumulated state. With concurrent exchanges sharing one instance the update and verify calls of different messages interleave, so a verification can complete against data that belongs to another exchange, or against a partially accumulated buffer. The outcome is non-deterministic and includes a verification reporting success for a message whose signature was never actually checked, which defeats the guarantee the component exists to provide. Reaching it requires concurrent traffic through the same endpoint, which is the ordinary condition for a Camel route under load.\n\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The Signature instance is no longer shared across concurrent exchanges. For deployments that cannot upgrade immediately, restrict the affected route to a single concurrent consumer so that no two exchanges use the instance at once.","summary":"The Apache Camel PQC component shares one java.security.Signature object across concurrent exchanges, so update and verify calls from different messages interleave. A message can be reported as verified when its signature was never actually checked.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","camel-pqc","java","package"],"not_affected_if":["no-pqc-component","unaffected-version"],"how_to_check":"- Check the Apache Camel version in the project build file (pom.xml or build.gradle) and confirm whether camel-pqc is on the classpath\n- Look for routes that use the PQC component (`pqc:` endpoints) with concurrent consumers\n- Run `mvn dependency:tree | grep camel-pqc` to confirm the component version","fix":"- Upgrade Apache Camel to `4.23.0`\n- On the 4.18.x LTS stream, upgrade to `4.18.5`\n- On the 4.22.x LTS stream, upgrade to `4.22.1`\n- If you cannot upgrade yet, restrict the affected route to a single concurrent consumer","status":"open","published_at":"2026-10-19T11:17:22+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:08:46+00:00","updated_at":"2026-10-25T04:08:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:08:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Camel to `4.23.0`\n- On the 4.18.x LTS stream, upgrade to `4.18.5`\n- On the 4.22.x LTS stream, upgrade to `4.22.1`\n- If you cannot upgrade yet, restrict the affected route to a single concurrent consumer","reach":"network","title":"Apache Camel PQC: shared Signature instance lets verification pass unchecked","impact":"medium","summary":"The Apache Camel PQC component shares one java.security.Signature object across concurrent exchanges, so update and verify calls from different messages interleave. A message can be reported as verified when its signature was never actually checked.","category":"package","nicknames":[],"who_cares":["java","apache-camel","camel-pqc"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Signature verification reports success for unchecked messages, defeating authenticity guarantees","analyst_note":"","how_to_check":"- Check the Apache Camel version in the project build file (pom.xml or build.gradle) and confirm whether camel-pqc is on the classpath\n- Look for routes that use the PQC component (`pqc:` endpoints) with concurrent consumers\n- Run `mvn dependency:tree | grep camel-pqc` to confirm the component version","needs_analyst":false,"not_affected_if":["unaffected-version","no-pqc-component"],"who_is_affected":"Applications using the Apache Camel PQC component from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 are affected. The flaw shows up under concurrent traffic through the same endpoint, which is normal for a route under load. Systems on other Camel versions or without the PQC component can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":3705,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85248':13A,16A '4.12.0':82C '4.18':223C '4.18.5':84C,231C '4.19.0':86C '4.22':235C '4.22.1':88C,243C '4.23.0':215C 'access':104C 'accumul':114C,126C,159C 'across':34B,251C 'actual':58B,180C 'affect':78C,262C 'anoth':153C 'apach':1A,18B,26B,72C,79C,213C 'apache-camel':17B 'belong':151C 'buffer':160C 'call':41B,138C 'camel':2A,19B,21B,27B,73C,80C,207C,214C 'camel-pqc':20B 'cannot':257C 'check':59B,181C 'complet':147C 'compon':29B,75C,187C 'concurr':35B,60C,129C,194C,252C,267C 'condit':69C,204C 'consum':124C,268C 'cve':11A,14A 'data':116C,149C 'defeat':183C 'deploy':255C 'determinist':166C 'differ':43B,140C 'endpoint':199C 'everi':100C 'exchang':36B,101C,130C,154C,253C,273C 'execut':61C 'exist':188C 'fix':217C 'guarante':185C 'held':91C 'immedi':259C 'improp':66C 'includ':168C 'instanc':6A,95C,133C,246C,276C 'interleav':45B,142C 'issu':77C,219C 'java':23B 'java.security.signature':32B,94C 'let':7A 'load':210C 'longer':249C 'lts':225C,237C 'messag':44B,47B,141C,175C 'never':57B,179C 'non':165C 'non-determinist':164C 'object':33B 'one':31B,132C 'ordinari':203C 'outcom':162C 'packag':24B 'partial':158C 'pass':9A 'pqc':3A,22B,28B,74C 'produc':90C 'provid':190C 'race':68C 'reach':191C 'releas':226C,238C 'report':50B,171C 'requir':193C 'resourc':64C 'restrict':260C 'rout':208C,263C 'safe':112C 'share':4A,30B,63C,131C,250C 'sign':119C 'signatur':5A,55B,105C,177C,245C 'singl':93C,266C 'state':107C,127C 'stream':227C,239C 'success':172C 'synchron':67C,103C 'thread':111C 'traffic':195C 'two':272C 'uncheck':10A 'updat':38B,113C,135C 'upgrad':211C,229C,241C,258C 'use':62C,97C,274C 'user':220C,232C 'verif':8A,145C,170C 'verifi':40B,52B,121C,123C,137C 'vulner':70C 'whose':176C 'without':102C 'x':224C,236C","nicknames":[],"mitigations":[],"who_affected":"Applications using the Apache Camel PQC component from 4.12.0 before 4.18.5 and from 4.19.0 before 4.22.1 are affected. The flaw shows up under concurrent traffic through the same endpoint, which is normal for a route under load. Systems on other Camel versions or without the PQC component can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85248","severity":null,"published_at":"2026-10-19T11:17:22+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}