CVE-2026-90885

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.1

Description Improper restriction of XML External Entity (XXE) references in the Apache Camel Saxon component occurs because the XQueryBuilder in camel-saxon uses a default Saxon Configuration that accepts DOCTYPE declarations and resolves external entities. While Camel's XML type converters protect bodies of type String, byte[], or InputStream, bodies that are already a javax.xml.transform.Source (such as those created via convertBodyTo(Source.class)) are passed to Saxon unchanged. This allows an external sender to provide a crafted XML body that can be used to read local files accessible by the Camel process or force the process to make requests to external hosts.

Recommendations Upgrade to version 4.23.0. For the 4.22.x stream, upgrade to 4.22.2. For the 4.18.x stream, upgrade to 4.18.5. As a temporary mitigation, avoid evaluating XQuery over a message body that is already a javax.xml.transform.Source when the XML comes from an untrusted sender. As a temporary mitigation, configure the xquery endpoint or language with a Saxon Configuration that refuses DOCTYPE declarations and disables external entities and external DTD loading.