CVE-2026-91858 (GCVE-0-2026-91858)
Vulnerability from cvelistv5
Published
2026-10-19 10:47
Modified
2026-10-19 14:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Summary
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Apache Software Foundation | Apache Camel |
Version: 4.0.0 Version: 4.19.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:29:43.649018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:30:10.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.camel:camel-fop",
"packageURL": "pkg:maven/org.apache.camel/camel-fop",
"product": "Apache Camel",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.18.5",
"status": "affected",
"version": "4.0.0",
"versionType": "maven"
},
{
"lessThan": "4.22.1",
"status": "affected",
"version": "4.19.0",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Cosentino"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrea Cosentino"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK\u0027s built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix.\u003c/p\u003e"
}
],
"value": "FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK\u0027s built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T10:47:48.267Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"name": "Apache Camel Security Advisory - CVE-2026-91858",
"tags": [
"vendor-advisory"
],
"url": "https://camel.apache.org/security/CVE-2026-91858.html"
},
{
"name": "CAMEL-24605",
"tags": [
"issue-tracking"
],
"url": "https://issues.apache.org/jira/browse/CAMEL-24605"
},
{
"name": "Fix on main, released in 4.23.0 (commit 209c67a851d3c145583d25829b7ffac0c500674b)",
"tags": [
"patch"
],
"url": "https://github.com/apache/camel/pull/26108"
},
{
"name": "Backport to camel-4.22.x, released in 4.22.1 (commit f689a9c92f0e6c406f9a0256c7d940024cf56782)",
"tags": [
"patch"
],
"url": "https://github.com/apache/camel/pull/26168"
},
{
"name": "Backport to camel-4.18.x, released in 4.18.5 (commit 9c06c6d265d70be30023e7514456b697e91db69e)",
"tags": [
"patch"
],
"url": "https://github.com/apache/camel/pull/26169"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. FopProducer now also sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it creates, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter, so external DTD and stylesheet access is refused on any JAXP implementation that honours those attributes. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.\u003c/p\u003e"
}
],
"value": "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. FopProducer now also sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it creates, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter, so external DTD and stylesheet access is refused on any JAXP implementation that honours those attributes. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFor deployments that cannot upgrade immediately, do not send untrusted XSL-FO to a fop producer. Alternatively, remove the third-party JAXP TransformerFactory such as Saxon-HE from the classpath, so that the JDK\u0027s built-in transformer is used, which already refuses external DTDs and external entities when secure processing is enabled.\u003c/p\u003e"
}
],
"value": "For deployments that cannot upgrade immediately, do not send untrusted XSL-FO to a fop producer. Alternatively, remove the third-party JAXP TransformerFactory such as Saxon-HE from the classpath, so that the JDK\u0027s built-in transformer is used, which already refuses external DTDs and external entities when secure processing is enabled."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91858",
"datePublished": "2026-10-19T10:47:48.267Z",
"dateReserved": "2026-09-15T09:22:12.094Z",
"dateUpdated": "2026-10-19T14:30:10.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-10-19T10:47:48.267Z\"}, \"title\": \"Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present\", \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-611 Improper Restriction of XML External Entity Reference\", \"lang\": \"en\", \"cweId\": \"CWE-611\", \"type\": \"CWE\"}]}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Camel\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"packageName\": \"org.apache.camel:camel-fop\", \"packageURL\": \"pkg:maven/org.apache.camel/camel-fop\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.18.5\", \"versionType\": \"maven\"}, {\"status\": \"affected\", \"version\": \"4.19.0\", \"lessThan\": \"4.22.1\", \"versionType\": \"maven\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"value\": \"FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK\u0027s built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix.\", \"lang\": \"en\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eFopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK\u0027s built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix.\u003c/p\u003e\"}]}], \"references\": [{\"url\": \"https://camel.apache.org/security/CVE-2026-91858.html\", \"name\": \"Apache Camel Security Advisory - CVE-2026-91858\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://issues.apache.org/jira/browse/CAMEL-24605\", \"name\": \"CAMEL-24605\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/apache/camel/pull/26108\", \"name\": \"Fix on main, released in 4.23.0 (commit 209c67a851d3c145583d25829b7ffac0c500674b)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/apache/camel/pull/26168\", \"name\": \"Backport to camel-4.22.x, released in 4.22.1 (commit f689a9c92f0e6c406f9a0256c7d940024cf56782)\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/apache/camel/pull/26169\", \"name\": \"Backport to camel-4.18.x, released in 4.18.5 (commit 9c06c6d265d70be30023e7514456b697e91db69e)\", \"tags\": [\"patch\"]}], \"metrics\": [{\"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\", \"baseSeverity\": \"MEDIUM\", \"baseScore\": 6.5, \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N\"}}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"For deployments that cannot upgrade immediately, do not send untrusted XSL-FO to a fop producer. Alternatively, remove the third-party JAXP TransformerFactory such as Saxon-HE from the classpath, so that the JDK\u0027s built-in transformer is used, which already refuses external DTDs and external entities when secure processing is enabled.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eFor deployments that cannot upgrade immediately, do not send untrusted XSL-FO to a fop producer. Alternatively, remove the third-party JAXP TransformerFactory such as Saxon-HE from the classpath, so that the JDK\u0027s built-in transformer is used, which already refuses external DTDs and external entities when secure processing is enabled.\u003c/p\u003e\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. FopProducer now also sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it creates, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter, so external DTD and stylesheet access is refused on any JAXP implementation that honours those attributes. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. FopProducer now also sets ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it creates, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter, so external DTD and stylesheet access is refused on any JAXP implementation that honours those attributes. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release.\u003c/p\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"Andrea Cosentino\", \"type\": \"finder\"}, {\"lang\": \"en\", \"value\": \"Andrea Cosentino\", \"type\": \"remediation developer\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-91858\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-19T14:29:43.649018Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-19T14:29:58.850Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-91858\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2026-09-15T09:22:12.094Z\", \"datePublished\": \"2026-10-19T10:47:48.267Z\", \"dateUpdated\": \"2026-10-19T14:30:10.376Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…