Apache Camel Saxon resolves external entities in bodies (CVE-2026-90885)
Original title: CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
camel-saxon before 4.18.5 and before 4.22.2 parses Source bodies with Saxon defaults; CVSS is 7.5.
Apache Camel's Saxon component has an XML external entity flaw. XQueryBuilder parsed a message body that was already a javax.xml.transform.Source using Saxon's default parser settings, so an external entity declared in that body was resolved. Affected ranges are camel-saxon 4.0.0 before 4.18.5 and 4.19.0 before 4.22.2. Scoring shows high confidentiality impact only.
- CVSS 3.1 score is 7.5, rated high.
- Vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
- The artifact is org.apache.camel:camel-saxon.
- Fixed versions named by the ranges are 4.18.5 and 4.22.2.
Impact: file disclosure through XML external entities
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-saxon | 4.0.0 before 4.18.5; 4.19.0 before 4.22.2 | 4.18.5 and 4.22.2 |
- 1.Upgrade org.apache.camel:camel-saxon to 4.18.5 or 4.22.2.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90885 | XXE in Apache Camel Saxon when body is already a Source | 7.5 | <1% | PoC |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 7. 5 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.