Apache Camel Fixes Multiple Vulnerabilities Including High-Severity XXE One’s

Apache Camel has released fixes for multiple security flaws, including high-severity XML External Entity vulnerabilities that could expose local files or reach internal systems.

The issues affect several components, with risks ranging from unsafe XML processing to remote code execution, stolen credentials, and failed access checks.

Apache’s security advisories list patched releases for each affected branch. The fixes cover different parts of Camel, so exposure depends on the components and settings an application uses.

Teams should check their deployed versions against the individual advisories rather than assume every Camel application faces the same risk. Several flaws require attacker-controlled messages to reach a specific processing path.

One significant issue, CVE-2026-90885, affects Camel-Saxon. Its XQueryBuilder processed message bodies already represented as javax.xml.transform.Source objects using Saxon’s default parser settings. This allowed an external entity declared inside the XML body to be resolved, creating an XXE weakness in that processing path.

According to Apache’s Camel-Saxon advisory, this issue is separate from CVE-2026-85250 in Camel-XPath. The XPath flaw appears when documentType=InputSource passes the payload to an engine that builds its own parser using JDK defaults. XML declarations blocked by the default document type could therefore be accepted through this alternative path.

Apache Camel Fixes Multiple Vulnerabilities

A third high-severity issue, CVE-2026-88901, affects Camel-Smooks. Its default XML reader resolved external general and parameter entities and loaded external document type definitions.

An attacker-controlled XML message could consequently read local files or contact internal hosts. Camel-FOP also received a medium-severity XXE fix for unsafe handling when certain third-party XML transformer implementations were present.

The broader update includes CVE-2026-88900, a high-severity unsafe Java deserialization flaw in Camel-JGroups that can lead to remote code execution.

Another high-severity issue, CVE-2026-78165, affects Camel-Spring-Redis. An attacker who can publish to a subscribed channel could exploit its default deserializer, which lacks an object input filter.

Camel-HTTP also contains a high-severity credential disclosure issue tracked as CVE-2026-85251. When followRedirects was enabled, the component attached the Authorization header to the destination named by a redirect, allowing a remote server to choose where those credentials were sent. Other fixes address OAuth authentication bypass and Keycloak token validation weaknesses.

These findings follow earlier coverage of Apache Camel header injection and attacks targeting Tomcat and Camel vulnerabilities. Those reports concern older flaws and should not be treated as evidence that the newly listed issues are being exploited.

For the Saxon flaw, Apache lists fixes in versions 4.18.5, 4.22.2, and 4.23.0. Apache fixed the XPath and Smooks issues in 4.18.5, 4.22.1, and 4.23.0.

Organizations choosing an upgrade should account for the later Saxon fix rather than stop at 4.22.1. Review deployed XML components, message entry points, and redirect settings during patch planning.

Use Apache’s component-specific version ranges to confirm coverage, especially where multiple Camel libraries are packaged within one application.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apache Camel Fixes Multiple Vulnerabilities Including High-Severity XXE One’s appeared first on Cyber Security News.