Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90885— Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Quick assessment

Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Camel 的 Saxon 组件中存在 XML 外部实体引用（XXE）限制不当的漏洞。 受影响版本范围： Apache Camel 4.0.0 至 4.18.5（不含 4.18.5） Apache Camel 4.19.0 至 4.22.2（不含 4.22.2） 漏洞详情： 在 模块中， 用于评估 XQuery 语言表达式及 xquery 组件。该组件在构建默认的 Saxon 配置时，仅设置了“去除空白字符”的解析选项，而未对 XML 解析器进行其他安全加固。因此，XML 解析器沿用其默认行为：接受

CVSS 7.5 · High EPSS 0.60% · P48

Affected Version Matrix 2

VendorProduct Version RangeStatus
Apache Software Foundation Apache Camel 4.0.0< 4.18.5 affected
4.19.0< 4.22.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90885

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Camel 4.0.0 ~ 4.18.5 -

II. Public POCs for CVE-2026-90885

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90885

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90885 (3)

Vendor Advisories for CVE-2026-90885 (3)

Same Patch Batch · Apache Software Foundation · 2026-10-26 · 12 CVEs total

CVE-2026-115748 8.8 HIGH Apache Vysper: Authorization bypass
CVE-2026-115721 7.5 HIGH Apache Vysper: Unbounded allocation
CVE-2026-95628 5.4 MEDIUM Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute P
CVE-2026-95629 5.4 MEDIUM Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Outp
CVE-2026-95664 5.4 MEDIUM Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS
CVE-2026-101259 5.3 MEDIUM Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-94386 4.8 MEDIUM Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Cre
CVE-2026-95663 4.8 MEDIUM Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached
CVE-2026-111422 Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as sh
CVE-2026-110748 Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
CVE-2026-110733 Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature stor

IV. Related Vulnerabilities

Same product: Apache Camel
Same vendor: Apache Software Foundation
Same weakness: CWE-611