Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Oracle
- Product
- java
- CVSS
- 7.5
- EPSS
- 0.006 (p46)
- Exposure class
- Developer platform, Web platform
Why it ranks 21 (Routine)
- CVSS 7.5 high
- Product class: developer platform, web platform
- Widely deployed vendor product (Oracle)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-85250 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.