oscerd opened a new pull request, #1827: URL: https://github.com/apache/camel-website/pull/1827
> **Hold until 4.22.2 is released.** Every advisory here names 4.22.2 among its > fixed versions, and `camel-core` 4.22.2 is not yet on Maven Central (4.18.5 and > 4.23.0 are). Please do not merge before the 4.22.2 artifacts are published. Adds the seven Apache Camel security advisories staged for the 4.22.2 release. | CVE | Severity | CWE | Component / issue | Fixed in | |---|---|---|---|---| | CVE-2026-90885 | HIGH 7.5 | CWE-611 | camel-saxon — `XQueryBuilder` parsed a body that was already a `javax.xml.transform.Source` with Saxon's default parser settings, resolving external entities | 4.18.5, 4.22.2, 4.23.0 | | CVE-2026-94386 | MEDIUM 4.8 | CWE-524 | camel-oauth — cross-scope token reuse via an under-keyed JVM-global client credentials token cache | 4.22.2, 4.23.0 | | CVE-2026-95628 | MEDIUM 5.4 | CWE-22 | camel-docling — custom CLI argument path validation does not reject absolute paths (incomplete fix of CVE-2026-40047) | 4.18.5, 4.22.2, 4.23.0 | | CVE-2026-95629 | MEDIUM 5.4 | CWE-22 | camel-docling — unvalidated output path header enables writing conversion output to an arbitrary directory | 4.18.5, 4.22.2, 4.23.0 | | CVE-2026-95663 | MEDIUM 4.8 | CWE-613 | camel-keycloak — security policy accepts expired access tokens because cached introspection results are not bounded by the token expiry | 4.18.5, 4.22.2, 4.23.0 | | CVE-2026-95664 | MEDIUM 5.4 | CWE-917 | camel-aws2-s3 — the producer evaluated an object key taken from the `CamelAwsS3Key` header as a Simple expression | 4.18.5, 4.22.2, 4.23.0 | | CVE-2026-101259 | MEDIUM 5.3 | CWE-209 | camel-coap — the consumer sent the exception message to the client as the payload of the 5.00 response | 4.18.5, 4.22.2, 4.23.0 | Each advisory ships as a `content/security/CVE-*.md` page plus the matching `CVE-*.txt.asc`, clear-signed with key `27663406EB6DBAF5291F2615E34E9F3802FF4100` (Andrea Cosentino). The final commit sets the `date` front-matter field of all seven to the publication date and re-signs each signed text, so every signature covers the content as published. Reported by Leon Zlobecki (CVE-2026-90885), Zhixi "Jace" Sun, independent security researcher (CVE-2026-95628, CVE-2026-95629, CVE-2026-101259), and found in-project (CVE-2026-94386, CVE-2026-95663, CVE-2026-95664). _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
