camel-saxon

Search everything

Mentions · 7d1
Mentions · 30d2
All mentions2
First seenOct 23, 2026
Last mentioned4d ago

Timeline

2 articles · newest first

Apache Camel patches XXE, deserialization, and credential flaws

Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.

Cyber Security NewsOct 27, 02:50 UTC · 4d agoVulnerabilityCVE-2026-90885 CVE-2026-85250 CVE-2026-88901+31

Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)

camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.

oss-securityOct 23, 13:12 UTC · 7d agoVulnerabilityCVE-2026-908853

Related CVEs

by mentions

CVE-2026-90885<1%7.5
XXE in Apache Camel Saxon when body is already a Source
published 4d agoApache Camel (camel-saxon)PoC
CVE-2026-88900<1%8.8
Unsafe Java deserialization RCE in Apache Camel JGroups
published 11d agoApache Camel (Camel-JGroups)PoC
CVE-2026-781658.8
Untrusted Java deserialization in Apache Camel Spring Redis
published 11d agoApache Camel
CVE-2026-889018.2
XXE in Apache Camel Smooks default XML reader
published 11d agoApache Camel
CVE-2026-852507.5
XXE in Apache Camel XPath when documentType is InputSource
published 11d agoApache Camel
CVE-2026-852517.5
Credential leak on redirect in Apache Camel HTTP
published 11d agoApache Camel HTTP component

Appears with

Apachevendor · 2
Apache Camelproduct · 2
Camel-JGroupsproduct · 1
Camel-Spring-Redisproduct · 1
Camel-Smooksproduct · 1
Camel-FOPproduct · 1
Camel-XPathproduct · 1
Camel-HTTPproduct · 1

Entities are extracted by the model from each article. First seen Oct 23, 2026, last mentioned 4d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.