CVE-2026-91858: FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body
CVE-2026-91858 key facts
- CISA KEV
- Not listed (catalogue checked )
- Highest advisory rating
- Medium
- CVSS base score
- 6.5 (Apache), 6.5 (Red Hat)
- Weakness
- CWE-611
- Fixed releases
- Apache: 4.18.5, 4.22.1
- Listed by VulniPulse
- Record changed
Ratings, versions and fixes are quoted from the vendor advisories that cover only CVE-2026-91858; each belongs to its advisory, not to every product listed. How records are collected and checked.
How do I fix CVE-2026-91858?
Upgrade to a fixed release named by the vendor:
- Apache: 4.18.5, 4.22.1
Vendor advisories for CVE-2026-91858
Apache
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-91858] FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body
CVE-2026-91858Source published Source updated
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform. TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general…
- Affected products in this advisory
- Apache Camel
- Source-reported affected versions
- 4.14
- Source-reported fixed versions
- 4.18.5
- 4.22.1
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Workarounds
- When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it.
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-91858] Information disclosure via XML external entity injection
CVE-2026-91858Source published Source updated
Information disclosure via XML external entity injection. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-611. Affected product named by the advisory: Red Hat Fuse 7.
- Related products — impact not confirmed
- Red Hat Fuse 7
- Source-reported affected versions
- < 4.14.x
- 4.14
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
References
More Apache advisories
CVE-2026-88901Oct 19, 2026Apache Camel XXECVE-2026-85315Oct 19, 2026Generation of Error Message Containing Sensitive Information vulnerability in Apache CamelCVE-2026-83531Oct 19, 2026Apache Camel expression language injectionCVE-2026-78162Oct 19, 2026Deserialization of Untrusted Data vulnerability in Apache CamelCVE-2026-80354Sep 10, 2026Authorization bypass through User-Controlled key vulnerability in Apache Camel KCVE-2026-80351Sep 10, 2026Improper neutralization of directives in dynamically evaluated code ('eval injection')
Get an email when Apache publishes the next one.
See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
