What is CVE-2016-8749?

CVE-2016-8749 is a critical-severity vulnerability in Apache Camel, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-03-28.

How severe is CVE-2016-8749?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2016-8749 known to be exploited?

8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache Camel

CVE-2016-8749

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

Vulnerability class: Insecure Deserialization

Published 2017-03-28 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.106 (95.8th percentile), scored 2026-10-22.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.106 · newest: 0.106 · change: 0.000

Affected products

Apache Camel — versions 2.16.0, 2.16.1, 2.16.2
Apache Software Foundation Camel — versions 2.17.0 to 2.17.4, 2.18.0 to 2.18.1, 2.16.0 to 2.16.4

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

access.redhat.com/errata/RHSA-2017:1832 (vendor-advisory, Third Party Advisory)
www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf (Technical Description, Exploit, Third Party Advisory)
camel.apache.org/security-advisories.data/CVE-2016-8749.txt.asc (Vendor Advisory)
www.securityfocus.com/bid/97179 (VDB Entry, Third Party Advisory, vdb-entry)
www.openwall.com/lists/oss-security/2017/05/22/2 (mailing-list, Mailing List, Third Party Advisory)
lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5… (mailing-list)
lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f… (mailing-list)

Frequently asked questions

What is CVE-2016-8749?: CVE-2016-8749 is a critical-severity vulnerability in Apache Camel, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-03-28.
How severe is CVE-2016-8749?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2016-8749 known to be exploited?: 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.