CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.
XQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camel camel-saxonto a version that resolves this vulnerability.Fixed in 4.23.0 - Configuration
Configure the xquery endpoint or language with a Saxon Configuration whose parse options refuse DOCTYPE declarations and disable external entity and external DTD loading.
xquery endpoint or language Saxon Configuration parse options = Refuse DOCTYPE declarations; disable external general entities, external parameter entities, and external DTD loading - Compensating control
Do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when it carries XML from an untrusted sender.
Event History
Frequently Asked Questions
Which routes are exposed to this issue?
Routes using XQueryBuilder in camel-saxon are exposed when the message body reaches the XQuery evaluation as a javax.xml.transform.Source that still requires parsing, such as a stream-based Source. Bodies supplied as String, byte[], or InputStream are converted by Camel with XML external-entity protections and are not affected by this path.
What would an attacker need to provide to exploit it?
An attacker would need to influence XML processed by an affected XQueryBuilder route so that it contains a DOCTYPE declaration with an external entity. The XML must be supplied to Saxon as a pre-existing Source that Saxon still needs to parse.
Are default parser settings affected?
Yes. The vulnerable default Saxon Configuration only set whitespace stripping and otherwise used parser defaults that accepted DOCTYPE declarations and resolved external entities. Camel's own XML type converters protected String, byte[], and InputStream bodies, but that protection was bypassed for already-created Source bodies.
How can I determine whether my routes use the affected path?
Inspect routes that use the xquery language or xquery component through XQueryBuilder, and identify whether an earlier route step calls convertBodyTo(Source.class) or a component or processor sets the body to a stream-based Source. Those cases can cause Saxon to parse the Source unchanged.
What can be done if an upgrade is not immediately possible?
Avoid passing untrusted XML to XQueryBuilder as a pre-existing Source that requires parsing. Where applicable, retain or convert the body to String, byte[], or InputStream so Camel's XML type converters apply their external-entity protections before Saxon receives it.