CVE-2026-90885: XML External Entity in Apache Camel

CVE-2026-90885 identifies a defect in Apache Camel's camel-saxon component, in XQueryBuilder. The vulnerability is Improper Restriction of XML External Entity Reference (CWE-611): when the message body is a javax.xml.transform.Source, Camel passes it to Saxon without XXE protection, allowing external entities in XML to expand. It affects XQuery routes processing data from untrusted external senders, especially with body converted to Source or stream-based Source.

The vulnerability scores CVSS 7.5 (HIGH), published on NVD on 2026-10-26. On the same date this article is written, a public GitHub reproducer appeared confirming reproducibility. The attack exploits Saxon's default Configuration without requiring non-standard setup. Versions from 4.0.0 through before 4.22.2 are vulnerable. An attacker can read files accessible to Camel and trigger outbound requests to hosts declared in the DOCTYPE.

Immediate upgrade for supported versions: 4.23.0 (recommended), 4.22.2 (4.22.x branch), 4.18.5 (4.18.x branch). Branches 4.14.x and earlier, 4.15.x-4.17.x, and 4.19.x-4.21.x are EOL with no patch and require migration. Meanwhile, do not process XQuery on Source with XML from untrusted senders. Temporary mitigation: configure camel-saxon with a Saxon Configuration that refuses DOCTYPE and disables external entities.