https://feed.craftedsignal.io/products/apache-camel-org.apache.camelcamel-saxon-4.0.0-before-4.18.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 13:38:47 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-apache-camel-xxe/Fri, 23 Oct 2026 13:38:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-camel-xxe/The Apache Camel Saxon component is affected by an Improper Restriction of XML External Entity Reference vulnerability. The issue occurs when XQueryBuilder parses a message body that is already a javax.xml.transform.Source, causing the component to use Saxon's default parser settings, which resolve external entities.Apache Camel's camel-saxon component is vulnerable to an Improper Restriction of XML External Entity Reference vulnerability. In affected versions, the XQueryBuilder parses a message body that is already a javax.xml.transform.Source using Saxon's default parser settings, which results in the resolution of external entities declared in the body.

]]>highadvisory