Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity

{
  "id": "6b46e71a38f3d42d5d987861fa79701e654fa7a7cdcdcea7b7bda59b1663a21a",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-90885",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity",
    "summary": "Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files read",
    "evidence": "cve:CVE-2026-90885",
    "products": [
      {
        "name": {
          "value": "Apache Camel",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-90885",
      "aliases": [
        "CVE-2026-90885"
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV3_1": {
            "scope": "UNCHANGED",
            "version": "3.1",
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "integrityImpact": "NONE",
            "userInteraction": "NONE",
            "attackComplexity": "LOW",
            "availabilityImpact": "NONE",
            "privilegesRequired": "NONE",
            "confidentialityImpact": "HIGH"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "affected": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Camel",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.18.5",
              "versionType": "maven"
            },
            {
              "status": "affected",
              "version": "4.19.0",
              "lessThan": "4.22.2",
              "versionType": "maven"
            }
          ],
          "packageURL": "pkg:maven/org.apache.camel/camel-saxon",
          "packageName": "org.apache.camel:camel-saxon",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected"
        }
      ],
      "modified": "2026-10-26T15:35:49.414Z",
      "provider": "cve",
      "references": [
        "https://camel.apache.org/security/CVE-2026-90885.html",
        "https://issues.apache.org/jira/browse/CAMEL-24691",
        "https://github.com/apache/camel/pull/26344",
        "https://github.com/apache/camel/pull/26728",
        "https://github.com/apache/camel/pull/26730",
        "https://camel.apache.org/security/CVE-2026-85250.html"
      ],
      "provider_metadata": {
        "adp": [
          {
            "title": "CISA ADP Vulnrichment",
            "metrics": [
              {
                "other": {
                  "type": "ssvc",
                  "content": {
                    "id": "CVE-2026-90885",
                    "role": "CISA Coordinator",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "version": "2.0.3",
                    "timestamp": "2026-10-26T15:29:02.992870Z"
                  }
                }
              }
            ],
            "providerMetadata": {
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP",
              "dateUpdated": "2026-10-26T15:35:49.414Z"
            }
          }
        ],
        "cna": {
          "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
          "shortName": "apache",
          "dateUpdated": "2026-10-26T14:47:03.155Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90885",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 316064,
  "published_at": "2026-10-26T14:47:03.155+00:00"
}