Apache Camel patches XXE, deserialization, and credential flaws
Original title: Apache Camel Fixes Multiple Vulnerabilities Including High-Severity XXE One’s
Saxon needs 4.18.5, 4.22.2, or 4.23.0; stopping at the XPath and Smooks fix 4.22.1 misses it.
Apache released fixes for multiple Camel component flaws, including high-severity XXE issues that can read local files or reach internal hosts. Other high-severity bugs cover unsafe Java deserialization in Camel-JGroups and Camel-Spring-Redis, plus Authorization header leakage on redirects in Camel-HTTP. Earlier Camel and Tomcat attack coverage is not evidence these new issues are exploited. Teams should match deployed components to each advisory's fixed versions.
Unconfirmed: The report does not confirm exploitation of the newly listed issues.
- CVE-2026-90885 is an XXE flaw in Camel-Saxon XQueryBuilder.
- CVE-2026-85250 is a separate Camel-XPath XXE path via documentType=InputSource.
- CVE-2026-88901 lets the Camel-Smooks XML reader resolve external entities.
- CVE-2026-88900 and CVE-2026-78165 can lead to remote code execution.
- CVE-2026-85251 sends the Authorization header to a redirect destination.
Impact: File read, internal access, RCE, or credential disclosure
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel-Saxon | — | 4.18.5, 4.22.2, and 4.23.0 |
| Apache Camel-XPath | — | 4.18.5, 4.22.1, and 4.23.0 |
| Apache Camel-Smooks | — | 4.18.5, 4.22.1, and 4.23.0 |
| Apache Camel-FOP | — | — |
| Apache Camel-JGroups | — | — |
| Apache Camel-Spring-Redis | — | — |
| Apache Camel-HTTP | — | — |
- 1.Upgrade Saxon to 4.18.5, 4.22.2, or 4.23.0 rather than stopping at 4.22.1.
- 2.Patch XPath and Smooks to 4.18.5, 4.22.1, or 4.23.0.
- 3.Review XML components, message entry points, and followRedirects settings.
- Vendors
- Apache
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78165+2 related CVEs | Untrusted Java deserialization in Apache Camel Spring Redis | 8.8 group max | — | ||
| CVE-2026-85251 | Credential leak on redirect in Apache Camel HTTP | 7.5 | — | ||
| CVE-2026-88900 | Unsafe Java deserialization RCE in Apache Camel JGroups | 8.8 | <1% | PoC | |
| CVE-2026-90885 | XXE in Apache Camel Saxon when body is already a Source | 7.5 | <1% | PoC |
From the original article
2 min read at cybersecuritynews.com
Apache Camel has released fixes for multiple security flaws, including high-severity XML External Entity vulnerabilities that could expose local files or reach internal systems. The issues affect several components, with risks ranging from unsafe XML processing to remote code execution, stolen credentials, and failed access checks. Apache’s security advisories list patched releases for each affected […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.