Description
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.



This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.



XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Published: 2026-10-26
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Remote Resource Disclosure
Action: Patch Immediately
AI Analysis

Impact

The vulnerability occurs when Apache Camel’s XQueryBuilder processes a message body that is already a javax.xml.transform.Source and contains a DOCTYPE declaration that the underlying Saxon parser accepts by default. This allows an external entity to be resolved and expanded during parsing, enabling an attacker to read local files or trigger outbound network requests from the Camel process. The flaw is a classic XML External Entity (XXE) issue, classified as CWE‑611, and can expose sensitive data or cause unintended network activity.

Affected Systems

The weakness affects Apache Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.1. Users on 4.22.x should upgrade to 4.22.2, and those on 4.18.x should upgrade to 4.18.5. Versions prior to 4.14.0, and the 4.15.x‑4.17.x and 4.19.x‑4.21.x streams are end‑of‑life and will not receive a fix, requiring migration to a supported release.

Risk and Exploitability

The CVSS score of 7.5 indicates a high risk level. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the flaw can be exploited by any component that accepts external XML. An attacker could supply crafted XML to an XQuery endpoint or processor that performs XQuery over a Source body. No special privileges are required beyond access to the Camel route, and the damage could include local file disclosure and arbitrary outbound requests. The attack vector is likely remote, involving untrusted XML input to the Camel service.

Generated by OpenCVE AI on October 26, 2026 at 16:40 UTC.

Remediation

Vendor Solution

Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. XQueryBuilder now builds its default Saxon Configuration with parse options that refuse a DOCTYPE declaration and disable external general entities, external parameter entities and external DTD loading, aligning a body that is already a javax.xml.transform.Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies. A body that reaches XQuery as an already-built Source and carries a DOCTYPE declaration is now rejected with a parse error. A Configuration supplied through the configuration option of the xquery endpoint or language is used as is and is not modified. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release.

Vendor Workaround

For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender. Alternatively, set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to version 4.23.0; if on the 4.22.x stream upgrade to 4.22.2; if on the 4.18.x stream upgrade to 4.18.5.
  • Configure the XQuery endpoint or language to use a Saxon Configuration that refuses DOCTYPE declarations and disables external entities and DTD loading, matching the hardened defaults of the fixed releases.
  • Avoid evaluating XQuery over a javax.xml.transform.Source that originates from an untrusted sender; if unavoidable, ensure the body is first converted to a type that Camel’s XML converters will sandbox, such as a String or byte[].

Generated by OpenCVE AI on October 26, 2026 at 16:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Camel
Apache camel
Vendors & Products Apache
Apache apache Camel
Apache camel

Mon, 26 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Title Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Apache Apache Camel Camel
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-26T15:35:49.414Z

Reserved: 2026-09-14T08:19:08.798Z

Link: CVE-2026-90885

cve-icon Vulnrichment

Updated: 2026-10-26T15:31:22.384Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T15:16:45.430

Modified: 2026-10-26T16:54:08.707

Link: CVE-2026-90885

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T17:30:15Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference