This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit e544469221624b50f0454246daa011915bc6435a Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 19 10:36:37 2026 +0200 Added CVE-2026-90885 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-90885.md | 25 +++++++++++++++++++++ content/security/CVE-2026-90885.txt.asc | 39 +++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) diff --git a/content/security/CVE-2026-90885.md b/content/security/CVE-2026-90885.md new file mode 100644 index 00000000..dc195594 --- /dev/null +++ b/content/security/CVE-2026-90885.md @@ -0,0 +1,25 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-90885" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-90885.html +draft: false +type: security-advisory +cve: CVE-2026-90885 +severity: HIGH +summary: "Camel-Saxon: XML external entity processing - XQueryBuilder parsed a message body that was already a javax.xml.transform.Source with Saxon's default parser settings, so an external entity declared in that body was resolved" +description: "XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML ty [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a [...] +credit: "This issue was discovered by Leon Zlobecki" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24691 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26344 (commit 9c23b6868bb92cb19c2b5a7ee624421d760cda8f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26728 (commit 0d0ed8bbe38fdae6e778c4f719e80c2e2d0e51b2) and to camel-4.18.x in https://github.com/apache/camel/pull/26730 (commit ed513f3a7117c3343a9e31e22e5627498f2fcdb6). + +XQueryBuilder now builds its default Saxon Configuration with parse options that enable the disallow-doctype-decl parser feature and disable the external-general-entities, external-parameter-entities and load-external-dtd features. This aligns a body that is already a Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies, and with camel-xslt-saxon, which already applies secure processing by default. The change is visible [...] + +The code path predates Apache Camel 4.0 and was already present in the 2.x and 3.x releases, so the affected range starts at 4.0.0 and every release line up to the fixed releases carries the issue. The 4.14.x line and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x lines, reached end of life before the fix and do not receive it. On the 4.22.x line the fix was backported after 4.22.1 had been cut, so 4.22.1 is affected and 4.22.2 is the first fixed release of that line. + +This issue is distinct from CVE-2026-85250, which concerned the documentType=InputSource option of camel-xpath and was fixed in 4.18.5, 4.22.1 and 4.23.0. Both concerned an input path that bypassed the parser hardening applied by default, but they are in different components and the fix for one does not cover the other; in particular, 4.22.1 resolves CVE-2026-85250 but not this issue. It is classified as CWE-611 (Improper Restriction of XML External Entity Reference). diff --git a/content/security/CVE-2026-90885.txt.asc b/content/security/CVE-2026-90885.txt.asc new file mode 100644 index 00000000..aa72caa5 --- /dev/null +++ b/content/security/CVE-2026-90885.txt.asc @@ -0,0 +1,39 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-90885" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-90885.html +draft: false +type: security-advisory +cve: CVE-2026-90885 +severity: HIGH +summary: "Camel-Saxon: XML external entity processing - XQueryBuilder parsed a message body that was already a javax.xml.transform.Source with Saxon's default parser settings, so an external entity declared in that body was resolved" +description: "XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML ty [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a [...] +credit: "This issue was discovered by Leon Zlobecki" +affected: "From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24691 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26344 (commit 9c23b6868bb92cb19c2b5a7ee624421d760cda8f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26728 (commit 0d0ed8bbe38fdae6e778c4f719e80c2e2d0e51b2) and to camel-4.18.x in https://github.com/apache/camel/pull/26730 (commit ed513f3a7117c3343a9e31e22e5627498f2fcdb6). + +XQueryBuilder now builds its default Saxon Configuration with parse options that enable the disallow-doctype-decl parser feature and disable the external-general-entities, external-parameter-entities and load-external-dtd features. This aligns a body that is already a Source with the hardened parser configuration that Camel's XmlConverter applies to String, byte[] and InputStream bodies, and with camel-xslt-saxon, which already applies secure processing by default. The change is visible [...] + +The code path predates Apache Camel 4.0 and was already present in the 2.x and 3.x releases, so the affected range starts at 4.0.0 and every release line up to the fixed releases carries the issue. The 4.14.x line and earlier, and the 4.15.x to 4.17.x and 4.19.x to 4.21.x lines, reached end of life before the fix and do not receive it. On the 4.22.x line the fix was backported after 4.22.1 had been cut, so 4.22.1 is affected and 4.22.2 is the first fixed release of that line. + +This issue is distinct from CVE-2026-85250, which concerned the documentType=InputSource option of camel-xpath and was fixed in 4.18.5, 4.22.1 and 4.23.0. Both concerned an input path that bypassed the parser hardening applied by default, but they are in different components and the fix for one does not cover the other; in particular, 4.22.1 resolves CVE-2026-85250 but not this issue. It is classified as CWE-611 (Improper Restriction of XML External Entity Reference). +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ +QQDH2AgAnOvWFBfccoiiYTB859+8ICI4FhFbkaCwUv+jsNJ6dP+5nlkPj9ACPZud +i7NqUbdO45e6m8eETehxU8FFVUOHNfzK5ktPRCmauZ7MavpEnCVcextcw+NYp7fV +X7teEKbIc6Wdj8ZRM1vGhHDC0QsMIi7zTfVloI7qMYfXkS6Y6/vP57r35wIU6VtY +OjrBAajXbCvvO1Cb/fG10q4MEKAtAzI8h6VzkBZo11TJclOlQdvImMlkT5QGJOp4 +Br+TDDJ+9DdKGtAHJAhlWvh+FCDPA5Jet2JyKZ8j02c6licT61p5FF3nRtx9K3tF +zQP6Py1DSYalPddrtUyPkoLgFucE/Q== +=za0T +-----END PGP SIGNATURE-----
