{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apache-camel-3.0.0-4.14.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:camel:4.19.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-90885"},{"cvss":5.3,"id":"CVE-2026-49099"},{"cvss":9.8,"id":"CVE-2026-40860"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache Camel (org.apache.camel:camel-saxon) 4.0.0 before 4.18.5","Apache Camel (org.apache.camel:camel-saxon) 4.19.0 before 4.22.2","Apache Camel (4.0.0 \u003c= 4.18.4, 4.19.0 \u003c= 4.22.1)","Apache Camel (\u003c 4.14.8, 4.18.3, 4.21.0)","Apache Camel (3.0.0-4.14.6)","Apache Camel (4.15.0-4.18.1)","Apache Camel (4.19.0-4.19.x)"],"_cs_severities":["critical"],"_cs_tags":["apache-camel","rce","deserialization","cve-2026-40860"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel's \u003ccode\u003ecamel-saxon\u003c/code\u003e component is vulnerable to an Improper Restriction of XML External Entity Reference vulnerability. In affected versions, the \u003ccode\u003eXQueryBuilder\u003c/code\u003e parses a message body that is already a \u003ccode\u003ejavax.xml.transform.Source\u003c/code\u003e using Saxon's default parser settings, which results in the resolution of external entities declared in the body.\u003c/p\u003e\n","date_modified":"2026-10-30T04:29:49Z","date_published":"2026-10-23T13:38:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-xxe/","summary":"The Apache Camel Saxon component is affected by an Improper Restriction of XML External Entity Reference vulnerability. The issue occurs when XQueryBuilder parses a message body that is already a javax.xml.transform.Source, causing the component to use Saxon's default parser settings, which resolve external entities.","title":"Apache Camel: XML External Entity Injection in Saxon Component (CVE-2026-90885)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Apache Camel (3.0.0-4.14.6)","version":"https://jsonfeed.org/version/1.1"}