CVE-2026-85248
Description
A flaw was found in the Apache Camel Post-Quantum Cryptography (PQC) component. The component reuses a single cryptographic signature instance across concurrent message exchanges without proper thread synchronization. Under concurrent processing conditions, signature operations from different messages can interleave, allowing an attacker to bypass cryptographic signature verification when unverified messages are mistakenly accepted as valid.
Statement
This vulnerability is classified as Moderate impact because exploiting the race condition requires specific timing and concurrent load to cause an integrity bypass, without directly affecting confidentiality or leading to remote code execution. Impact is limited to applications actively utilizing the optional Apache Camel Post-Quantum Cryptography (camel-pqc) component. Routes that do not employ this cryptographic module or that process messages sequentially are unaffected.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
