This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 7a03df6d4aeb523e14ecbb7b1d772550fe5dd285 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 4 09:09:42 2026 +0200 Added CVE-2026-85250 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_013qz9ir11vuQYfQApzwHAHD Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-85250.md | 21 ++++++++++++++++++++ content/security/CVE-2026-85250.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-85250.md b/content/security/CVE-2026-85250.md new file mode 100644 index 00000000..4f45abd1 --- /dev/null +++ b/content/security/CVE-2026-85250.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-85250" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85250.html +draft: false +type: security-advisory +cve: CVE-2026-85250 +severity: HIGH +summary: "Camel-XPath: XML external entity processing - the documentType=InputSource option handed the payload to an XPath engine that built its own parser with JDK defaults, so a DOCTYPE refused on the default document type was accepted and its external entity resolved" +description: "With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment th [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24475 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25683 (commit 1ead256f1bfcef36c2572a88809bcd7547bdc111), backported to camel-4.22.x in https://github.com/apache/camel/pull/25940 (commit 260989268cbc6d258b1fcba63770be8ebbec40cb) and to camel-4.18.x in https://github.com/apache/camel/pull/25942 (commit af1efbcccf5882b1ef0094db718972da3190e7e9). + +The issue is classified as CWE-611 Improper Restriction of XML External Entity Reference. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. diff --git a/content/security/CVE-2026-85250.txt.asc b/content/security/CVE-2026-85250.txt.asc new file mode 100644 index 00000000..3c7b2ff9 --- /dev/null +++ b/content/security/CVE-2026-85250.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-85250" +date: 2026-08-31T10:00:00+02:00 +url: /security/CVE-2026-85250.html +draft: false +type: security-advisory +cve: CVE-2026-85250 +severity: HIGH +summary: "Camel-XPath: XML external entity processing - the documentType=InputSource option handed the payload to an XPath engine that built its own parser with JDK defaults, so a DOCTYPE refused on the default document type was accepted and its external entity resolved" +description: "With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment th [...] +credit: "This issue was discovered by Claude Security Scan Tool" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24475 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25683 (commit 1ead256f1bfcef36c2572a88809bcd7547bdc111), backported to camel-4.22.x in https://github.com/apache/camel/pull/25940 (commit 260989268cbc6d258b1fcba63770be8ebbec40cb) and to camel-4.18.x in https://github.com/apache/camel/pull/25942 (commit af1efbcccf5882b1ef0094db718972da3190e7e9). + +The issue is classified as CWE-611 Improper Restriction of XML External Entity Reference. The camel-4.14.x line reached end of life before this fix and does not receive it; deployments on 4.14.x should move to 4.18.5 or later. +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqabrYACgkQ406fOAL/ +QQDsGwf/a2r2jsRfyhjfQju2boAvhU0Mjwle+LEKzSmY1aCy+rYXer+PMtRcSqEY +sFF7vS38U8GXknEID2X78iHk6w8kvPY8DaZLFyE7NmVJwCiJwx1EropXrE+1seXv +5ZB/vnGvl8QGQfs4voXFp+ZbwCq67OKKWIqKPsyUeBmP8JHMRzbOOxBfadK3KZ6E +j+AHmOwzPIwEeqWcfSb+U7/3oQGRdurY8LaUckCerBbMkPv7J/ZTYtB826rp2t2x +coMXZn8WoB4sINPgOphFJchkwoK0lsqNW3du9AfZAZnlGWFSuIm0IFJ8VIz6va2m +Cs0kt8udfQ68zjv3ONIGN2hNyt2giQ== +=TvsS +-----END PGP SIGNATURE-----
