CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: forced Xalan TransformerFactory drops the JAXP external access restrictions Runnable proof-of-concept reproducer for the Apache Camel Quarkus vulnerability where the XSLT support extension camel-quarkus-support-xalan supplies its own Xalan-backed TransformerFactory...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

EUVD-2026-90762

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

Exploit for CVE-2026-88789

CVE-2026-88789 — Camel Quarkus: forced Xalan TransformerFacto...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

PT-2026-103830

Name of the Vulnerable Software and Affected Versions Apache Camel Quarkus versions 3.2.0 through 3.33.2 Apache Camel Quarkus versions 3.34.0 through 3.39.9 Description Improper restriction of XML External Entity XXE references in the XSLT support extension camel-quarkus-support-xalan allows an...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: GHSA-F78G-9385-QXQJ...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: MEND:CVE-2026-66907...

com.srcclr:srcclr-maven-plugin (>=3.1.23, <=3.1.25), org.apache.camel.quarkus:camel-quarkus-opensearch (3.24.0) +20 more potentially affected by CVE-2026-59638 via org.bouncycastle:bctls-fips (>=1.0.9, <=1.0.19)

org.bouncycastle:bctls-fips MAVEN version =1.0.9, =3.1.23, =19.0.0, =14.6.5.3, =4.4.12, =4.4.12, =4.4.12, =4.4.12, =4.4.12, =4.6.4, =4.4.12, =4.4.12, =4.4.12, =4.4.12, =4.9.4 and more Source cves: CVE-2026-59638 Source advisory: MEND:CVE-2026-59638...

org.apache.camel.kafkaconnector:camel-couchbase-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:itests-couchbase (4.18.0) +4 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.15.0, <=4.18.2)

org.apache.camel:camel-couchbase MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =4.15.0, =4.18.2 Source cves: CVE-2026-46587 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17822328...

org.apache.camel.quarkus:camel-quarkus-couchbase (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-couchbase-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.19.0, <=4.20.0)

org.apache.camel:camel-couchbase MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46587 Source advisory: OSV:GHSA-46JF-C9VX-HH79...

org.apache.camel.quarkus:camel-quarkus-couchbase (>=3.35.0, <=3.36.0), org.apache.camel.quarkus:camel-quarkus-couchbase-deployment (>=3.35.0, <=3.36.0) +1 more potentially affected by CVE-2026-46587 via org.apache.camel:camel-couchbase (>=4.19.0, <=4.20.0)

org.apache.camel:camel-couchbase MAVEN version =4.19.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-46587 Source advisory: GHSA-46JF-C9VX-HH79...