CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

EUVD-2026-90762

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...