CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
Apache Camel Quarkus CVE-2026-88789 forces Xalan and drops external DTD and stylesheet hardening.
Apache disclosed CVE-2026-88789 in camel-quarkus-support-xalan, rated CVSS 3.1 8.6 (high) with network access, no privileges or user interaction, changed scope, and high confidentiality impact. Forcing the Xalan TransformerFactory drops upstream hardening against external DTDs and stylesheets. Affected versions are 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0; 3.33.3 is listed as unaffected. The posted advisory does not report exploitation in the wild.
- CVE-2026-88789 is scored CVSS 3.1 8.6 with high confidentiality impact.
- Forcing the Xalan TransformerFactory drops external DTD and stylesheet hardening.
- Affected ranges are 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0.
- Version 3.33.3 is listed as unaffected; exploitation is not reported.
- CVEs
- CVE-2026-88789
- Vendors
- Apache
- Products
- Apache Camel QuarkusXalan
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88789 | Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before… | 8.6 | <1% | PoC |
From the original article
Posted by James Netherton on Oct 01 Severity: CVSS 3. 1: 8. 6 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.