CVE-2026-91858

A flaw was found in camel-fop. When third-party XML processing libraries are present on the classpath, the component fails to properly restrict external resource resolution during document transformations. A remote attacker can exploit this flaw by submitting a crafted document containing externa...

CVE-2026-91858

CVE-2026-91858 — camel-fop: XML External Entity XXE via a third-party TransformerFactory Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-fop's FopProducer created its javax.xml.transform.TransformerFactory with only FEATURESECUREPROCESSING before running an...

Exploit for CVE-2026-91858

CVE-2026-91858 — camel-fop: XML External Entity XXE via a th...

Apache Camel camel-fop 4.22.0 XML External Entity

Apache Camel camel-fop version 4.22.0 contains an XML external entity issue when a third-party TransformerFactory is present. The proof of concept demonstrates external DTD resolution through an in-process localhost callback. https://packetstorm.news/download/236737...

org.apache.camel.karaf:camel-fop (>=4.7.0, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-fop (>=3.2.0, <=3.33.3) +3 more potentially affected by CVE-2026-91858 via org.apache.camel:camel-fop (>=4.0.0, <=4.18.4)

org.apache.camel:camel-fop MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 Source cves: CVE-2026-91858 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430140...

org.apache.camel.quarkus:camel-quarkus-fop (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-fop-deployment (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-91858 via org.apache.camel:camel-fop (>=4.19.0, <=4.22.0)

org.apache.camel:camel-fop MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-91858 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430140...

CVE-2026-91858

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-91858 Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

org.apache.camel.karaf:camel-fop (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-fop (>=3.29.0, <=3.33.3) +3 more potentially affected by CVE-2026-91858 via org.apache.camel:camel-fop (>=4.15.0, <=4.18.4)

org.apache.camel:camel-fop MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.4 Source cves: CVE-2026-91858 Source advisory: MEND:CVE-2026-91858...

CVE-2026-91858 Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

org.apache.camel.quarkus:camel-quarkus-fop (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-fop-deployment (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-91858 via org.apache.camel:camel-fop (>=4.19.0, <=4.22.0)

org.apache.camel:camel-fop MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-91858 Source advisory: MEND:CVE-2026-91858...

CVE-2026-91858 Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

EUVD-2026-104208

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-91858

The camel-fop component in Apache Camel is vulnerable to XML External Entity (XXE) injection when a third-party JAXP TransformerFactory (such as Saxon-HE ) is present on the classpath. The FopProducer uses TransformerFactory.newInstance() and only enables FEATURE_SECURE_PROCESSING. While this pro...

CVE-2026-91858

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

PT-2026-117366

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURE SECURE PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-91858: Improper Restriction of XML External Entity Reference

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...