HighCVE
Apache Camel Fixes Multiple Vulnerabilities Including High-Severity XXE One’s
Cyber Security News·Source published ·1 min read
What happened?
Apache Camel has released fixes for multiple security flaws, including high-severity XML External Entity vulnerabilities that could expose local files or reach internal systems. The issues affect several components, with risks ranging from unsafe XML processing to remote code execution, stolen credentials, and failed access checks. Apache’s security advisories list patched releases for each affected branch. The fixes cover different parts of Camel, so exposure depends on the components and settings an application uses.
Key details
- Apache Camel released fixes for multiple security flaws including high-severity XXE vulnerabilities.
- CVE-2026-90885 in Camel-Saxon allows XXE via XQueryBuilder using Saxon default parser settings.
- CVE-2026-88900 in Camel-JGroups allows remote code execution via unsafe Java deserialization.
- CVE-2026-78165 in Camel-Spring-Redis permits exploitation via default deserializer lacking object input filter.
- CVE-2026-85251 in Camel-HTTP discloses credentials by attaching Authorization header to redirect destinations.
Affected
- Camel-FOP component received a medium-severity XXE fix.
Fixes and mitigations
- XPath and Smooks issues fixed in versions 4.18.5, 4.22.1, and 4.23.0.
- Organizations should account for later Saxon fix rather than stop at 4.22.1.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.