CVE-2026-90885

CVE-2026-90885 — camel-saxon: XQuery over an already-built Source was parsed with Saxon's defaults XXE Runnable proof-of-concept reproducer for the Apache Camel vulnerability where XQueryBuilder in camel-saxon — which evaluates expressions for both the xquery language and the xquery component —...

CVE-2026-91858

CVE-2026-91858 — camel-fop: XML External Entity XXE via a third-party TransformerFactory Runnable proof-of-concept reproducer for the Apache Camel vulnerability where camel-fop's FopProducer created its javax.xml.transform.TransformerFactory with only FEATURESECUREPROCESSING before running an...

CVE-2026-90885

A flaw was found in Apache Camel's camel-saxon component. A remote attacker can exploit this vulnerability to cause information disclosure by sending specially crafted XML containing external entity declarations to an affected route. The issue occurs because the component's default parser...

org.apache.camel.karaf:camel-saxon (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-foundation-grouped (>=3.29.0, <=3.33.3) +4 more potentially affected by CVE-2026-90885 via org.apache.camel:camel-saxon (>=4.15.0, <=4.18.4)

org.apache.camel:camel-saxon MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.4 Source cves: CVE-2026-90885 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21762839...

org.apache.camel.quarkus:camel-quarkus-integration-test-foundation-grouped (>=3.35.0, <=3.40.0), org.apache.camel.quarkus:camel-quarkus-integration-test-saxon (>=3.35.0, <=3.40.0) +3 more potentially affected by CVE-2026-90885 via org.apache.camel:camel-saxon (>=4.19.0, <=4.22.1)

org.apache.camel:camel-saxon MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.1 Source cves: CVE-2026-90885 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21762839...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the XQueryBuilder process when parsing a message body that is already a javax.xml.transform.Source with Saxon's default parser settings. An attacker can access files readable by the process or cause...

CVE-2026-90885

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-90885

The Apache Camel Saxon component (specifically XQueryBuilder ) is vulnerable to an Improper Restriction of XML External Entity Reference (XXE) vulnerability. The root cause is that the component's default Saxon Configuration only enforces whitespace stripping, leaving the XML parser in a state wh...

CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

EUVD-2026-109959

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

CVE-2026-90885

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component,...

org.apache.camel.quarkus:camel-quarkus-integration-test-foundation-grouped (>=3.35.0, <=3.40.0), org.apache.camel.quarkus:camel-quarkus-integration-test-saxon (>=3.35.0, <=3.40.0) +3 more potentially affected by CVE-2026-90885 via org.apache.camel:camel-saxon (>=4.19.0, <=4.22.1)

org.apache.camel:camel-saxon MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.1 Source cves: CVE-2026-90885 Source advisory: MEND:CVE-2026-90885...

org.apache.camel.karaf:camel-saxon (>=4.7.0, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-foundation-grouped (>=3.2.0, <=3.33.3) +5 more potentially affected by CVE-2026-90885 via org.apache.camel:camel-saxon (>=4.0.0, <=4.18.4)

org.apache.camel:camel-saxon MAVEN version =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.18.4 Source cves: CVE-2026-90885 Source advisory: MEND:CVE-2026-90885...

Apache Camel input validation error vulnerability

Security vulnerabilities exist in Apache Camel versions 4.0.0 through 4.18.5 and 4.19.0 through 4.22.2. These stem from the XQueryBuilder in camel-saxon, which uses the default Saxon Configuration to parse stream-based Source message bodies. No restrictions are placed on DOCTYPE declarations or...

Exploit for CVE-2026-91858

CVE-2026-91858 — camel-fop: XML External Entity XXE via a th...

CVE-2026-91858

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

PT-2026-117366

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURE SECURE PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

org.apache.camel.quarkus:camel-quarkus-integration-test-tika (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-integration-test-xj (>=3.35.0, <=3.39.0) +15 more potentially affected by CVE-2026-88789 via org.apache.camel.quarkus:camel-quarkus-support-xalan (>=3.35.0, <=3.39.0)

org.apache.camel.quarkus:camel-quarkus-support-xalan MAVEN version =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.39.0 and mo...