Skip to content
VulniPulse
Sign in
Advisory severityHigh8.2Apache Software Foundation Updated

High [CVE-2026-88901] Improper Restriction of XML External Entity Reference vulnerability in Apache Camel

This high-severity Apache Software Foundation advisory covers CVE-2026-88901 affecting Apache Camel.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-88901 Source published Source updated

VulniPulse record published Record updated

CVE-2026-88901
Affected products & platforms
Apache Software FoundationMessaging
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.

This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1.

The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser.

That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply.

A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes.

An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour.

Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.

Upgrade to Apache Camel 4.23.0, which fixes the issue.

Affected versions
  • 4.7.0 before 4.18.5
  • 4.19.0 before 4.22.1

Official advisory · high-confidence parse· fetched 2 days ago·verify at source

Fixed versions
  • 4.18.5
  • 4.22.1
  • 4.23.0

Official advisory · high-confidence parse· fetched 2 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply.
  • Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.
  • Upgrade to Apache Camel 4.23.0, which fixes the issue.
  • Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
  • Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.
  • For deployments that cannot upgrade immediately, do not apply camel-smooks to XML received from untrusted senders.

Official advisory · high-confidence parse· fetched 2 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.