CVE-2026-90885
Awaiting Analysis Awaiting Analysis - Queue

XML External Entity Processing in Apache Camel

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Apache Software Foundation

Description
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-90885
EUVD
EUVD-2026-109959

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90885 is an XML External Entity (XXE) vulnerability in Apache Camel's camel-saxon component. The XQueryBuilder component did not enforce secure XML parsing by default. When processing message bodies already converted to javax.xml.transform.Source, it used Saxon's default parser settings which allowed external entity resolution. This bypassed security measures applied to other body types like String or InputStream. Attackers could exploit this to read files accessible to the Camel process or make unauthorized network requests by sending malicious XML with external entities.

Detection Guidance

To detect this vulnerability, inspect Apache Camel routes that process XML using XQuery expressions or the xquery endpoint. Check if message bodies are converted to javax.xml.transform.Source (e.g., via convertBodyTo(Source.class)) and if untrusted XML with DOCTYPE declarations is processed. Review logs for parse errors or unexpected network requests originating from Camel processes.

Impact Analysis

This vulnerability allows an attacker to read sensitive files on the system running Apache Camel if the application processes untrusted XML input converted to Source type. It also enables the attacker to make network requests to internal or external hosts using the permissions of the Camel process. The impact includes potential data breaches, unauthorized access to system files, and network reconnaissance.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. Exploitation of this XXE vulnerability could result in unauthorized data exposure, triggering compliance violations and potential regulatory penalties.

Mitigation Strategies

Upgrade Apache Camel to version 4.23.0, 4.22.2, or 4.18.5 depending on your release stream. If upgrading is not possible, avoid evaluating XQuery over Source-type message bodies from untrusted senders. Alternatively, configure the xquery endpoint or language to use a Saxon Configuration that disables DOCTYPE declarations and external entities (disallow-doctype-decl=true, external-general-entities=false, external-parameter-entities=false, load-external-dtd=false).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90885. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart