CVE-2026-6857

Published: Apr 22, 2026Modified: Jul 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbitrary code execution. This allows the attacker to gain full control over the affected system, impacting its confidentiality, integrity, and availability.

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (9)

https://access.redhat.com/errata/RHSA-2026:17668

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:22453

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-6857

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2460003

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:17668

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/errata/RHSA-2026:22453

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/security/cve/CVE-2026-6857

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2460003

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6857.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.