{"id":"CVE-2026-90885","kind":"vulnerability","aliases":["CVE-2026-90885"],"related":[],"title":"Apache Camel Saxon: XQuery resolves external entities from untrusted XML bodies","description":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.\n\n\n\nXQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.","summary":"The XQuery evaluator in Apache Camel's camel-saxon component builds a Saxon configuration that accepts DOCTYPE declarations and resolves external entities when the body is already a stream-based javax.xml.transform.Source. An external sender can use this to read files the Camel process can read and make it send requests to hosts the document names.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","camel-saxon","integration","java","package","xquery"],"not_affected_if":["fixed-version","no-xquery-usage","string-or-bytes-bodies-only","trusted-input-only"],"how_to_check":"- Check the Camel version in use, for example with `mvn dependency:tree | grep camel-saxon` or the camel-saxon version in the lockfile or pom.\n- Look for XQuery expressions or xquery endpoints that receive a Source body, such as after `convertBodyTo(Source.class)`, and that process XML from untrusted senders.","fix":"- Upgrade camel-saxon and Apache Camel to `4.23.0`, or `4.22.2` on the 4.22.x stream, or `4.18.5` on the 4.18.x stream.\n- Move off 4.14.x, 4.15.x to 4.17.x, and 4.19.x to 4.21.x, which are end of life and will not receive a fix.\n- Without an immediate upgrade, stop evaluating XQuery over a Source body that carries untrusted XML, or set the xquery endpoint or language configuration to a Saxon Configuration that refuses DOCTYPE and disables external entities and external DTD loading.","status":"open","published_at":"2026-10-26T15:16:45+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:42+00:00","updated_at":"2026-10-26T16:03:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T16:03:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade camel-saxon and Apache Camel to `4.23.0`, or `4.22.2` on the 4.22.x stream, or `4.18.5` on the 4.18.x stream.\n- Move off 4.14.x, 4.15.x to 4.17.x, and 4.19.x to 4.21.x, which are end of life and will not receive a fix.\n- Without an immediate upgrade, stop evaluating XQuery over a Source body that carries untrusted XML, or set the xquery endpoint or language configuration to a Saxon Configuration that refuses DOCTYPE and disables external entities and external DTD loading.","reach":"internet","title":"Apache Camel Saxon: XQuery resolves external entities from untrusted XML bodies","impact":"medium","summary":"The XQuery evaluator in Apache Camel's camel-saxon component builds a Saxon configuration that accepts DOCTYPE declarations and resolves external entities when the body is already a stream-based javax.xml.transform.Source. An external sender can use this to read files the Camel process can read and make it send requests to hosts the document names.","category":"package","nicknames":[],"who_cares":["apache-camel","java","camel-saxon","xquery","integration"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads server files and triggers outbound requests from the Camel process","analyst_note":"","how_to_check":"- Check the Camel version in use, for example with `mvn dependency:tree | grep camel-saxon` or the camel-saxon version in the lockfile or pom.\n- Look for XQuery expressions or xquery endpoints that receive a Source body, such as after `convertBodyTo(Source.class)`, and that process XML from untrusted senders.","needs_analyst":false,"not_affected_if":["no-xquery-usage","string-or-bytes-bodies-only","trusted-input-only","fixed-version"],"who_is_affected":"Applications on Apache Camel 4.0.0 before 4.18.5 or 4.19.0 before 4.22.2 that use camel-saxon for XQuery. Exposure requires that untrusted XML reaches an XQuery expression or xquery endpoint with a body that is already a Source, which happens after conversions like convertBodyTo(Source.class) or when an earlier component sets a stream-based Source. Routes that only handle String, byte[] or InputStream bodies, or that do not use XQuery, are not affected by this path.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000844,"input_tokens":4068,"output_tokens":875,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90885':14A,17A '4.0.0':104C '4.14':413C '4.15':423C '4.17':426C '4.18':400C '4.18.5':106C,411C '4.19':429C '4.19.0':108C '4.21':432C '4.22':383C '4.22.2':110C,394C '4.23.0':373C 'accept':44B,155C 'affect':100C,201C 'alreadi':55B,206C,477C 'apach':1A,19B,32B,94C,101C 'apache-camel':18B 'appli':240C,526C 'aris':249C 'base':59B,228C,278C 'bodi':11A,53B,163C,171C,198C,203C,244C,248C,273C,293C,474C,482C 'build':39B 'built':127C 'bypass':237C 'byte':168C 'camel':2A,20B,22B,33B,36B,71B,95C,102C,114C,183C,329C 'camel-saxon':21B,35B,113C 'cannot':464C 'carri':483C 'caus':332C 'compon':38B,97C,126C,264C 'configur':42B,131C,190C,236C,353C,492C,503C 'convert':188C,255C 'convertbodyto':259C 'could':323C 'cve':12A,15A 'declar':46B,153C,290C,510C 'default':129C,148C,346C,352C,528C 'deploy':452C,462C 'disabl':512C 'doctyp':45B,152C,281C,509C 'document':83B,301C,341C 'dtd':517C 'earlier':267C,418C 'end':437C 'endpoint':319C,497C 'entiti':7A,50B,90C,158C,195C,289C,514C 'evalu':30B,117C,305C,469C 'exampl':251C 'expand':298C 'express':118C,303C,315C 'extern':6A,49B,62B,89C,157C,194C,284C,288C,308C,513C,516C 'file':69B,325C 'first':177C 'fix':375C,450C,523C 'form':322C 'hand':211C 'host':81B,339C 'howev':209C 'immedi':466C 'improp':85C 'inputstream':175C 'integr':24B 'issu':99C,336C,377C,442C 'java':25B 'javax.xml.transform.source':60B,181C,479C 'languag':122C,499C 'leav':142C 'life':439C 'line':435C 'load':518C 'make':76B 'messag':162C,257C,473C 'move':456C 'must':455C 'name':84B,342C 'non':345C 'non-default':344C 'one':362C 'option':134C,347C,493C,506C 'packag':26B 'pars':133C,223C,232C,505C 'parser':145C,192C 'process':72B,330C,334C 'processor':266C 'protect':239C 'reach':312C,436C 'read':68B,74B,172C,324C 'readabl':326C 'receiv':448C 'recommend':368C 'refer':91C 'refus':507C 'releas':385C,402C,415C,434C,460C,524C 'request':79B,337C 'requir':349C 'resolv':5A,48B,160C,296C,444C 'restrict':86C 'rout':254C,270C,358C 'rule':141C 'saxon':3A,23B,37B,41B,96C,115C,130C,213C,231C,502C 'send':78B 'sender':63B,309C,488C 'set':136C,271C,490C 'sinc':350C 'sourc':208C,218C,229C,279C 'source.class':260C 'still':219C 'stream':58B,227C,277C,386C,403C,416C 'stream-bas':57B,226C,276C 'string':166C 'strip':140C 'subset':285C 'suggest':390C,407C 'suppli':361C 'support':459C 'therefor':295C 'turn':178C 'type':165C,187C,245C 'unchang':214C 'untrust':9A,487C 'upgrad':370C,392C,409C,465C 'use':65B,355C 'user':366C,379C,396C 'version':372C 'vulner':92C 'well':420C 'whenev':356C 'whitespac':139C 'whose':310C,504C 'x':384C,401C,414C,424C,427C,430C,433C 'xml':10A,88C,144C,186C,311C,484C 'xqueri':4A,27B,29B,121C,125C,314C,318C,470C,496C 'xquerybuild':111C","nicknames":[],"mitigations":[],"who_affected":"Applications on Apache Camel 4.0.0 before 4.18.5 or 4.19.0 before 4.22.2 that use camel-saxon for XQuery. Exposure requires that untrusted XML reaches an XQuery expression or xquery endpoint with a body that is already a Source, which happens after conversions like convertBodyTo(Source.class) or when an earlier component sets a stream-based Source. Routes that only handle String, byte[] or InputStream bodies, or that do not use XQuery, are not affected by this path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90885","severity":null,"published_at":"2026-10-26T15:16:45+00:00","modified_at":"2026-10-26T15:16:45+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}