org.apache.camel:camel-saxon vulnerabilities

CVEs whose affected-version data names the org.apache.camel:camel-saxon package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-90885High· 7.5

2d ago

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. XQueryBuilder in camel-saxon, which evaluate…

▾ TwilightApache Software Foundation · org.apache.camel:camel-saxonEPSS 0.60%via CVEORG