Loading story…
Apache disclosed CVE-2026-88789, a high-severity XXE flaw (CVSS 8.6, CWE-611) in the camel-quarkus-support-xalan XSLT extension. The extension forces legacy Xalan-J 2.7.x as the default JAXP TransformerFactory, which does not honor Camel’s external-DTD and stylesheet access restrictions. An unauthenticated attacker able to provide XML for transformation as a javax.xml.transform.Source could use external entities to read local files or induce requests to internal network services. Versions 3.2.0 through 3.33.2 and 3.34.0 through 3.39.x are affected; XML bodies converted to hardened SAXSource objects are not on the directly affected path.
Camel Quarkus fixed the issue in versions 3.33.3 and 3.40.0 by enforcing parser-level blocks on external general entities, external parameter entities, and external DTDs within its Xalan transformer factory. The fix also denies XSLT document() resource retrieval unless an application-provided URIResolver explicitly authorizes it, while retaining application and per-exchange resolver behavior. Organizations using affected releases should upgrade promptly and review direct use of TransformerFactory.newInstance() and any intentionally configured URI resolvers; XSLT xsl:import and xsl:include remain outside these specific runtime controls because Xalan resolves them during stylesheet compilation.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-88789 was published as a high-severity CWE-611 XXE vulnerability affecting camel-quarkus-support-xalan versions before 3.33.3 in the 3.2.x–3.33.x line and before 3.40.0 in the 3.34.x–3.39.x line. An unauthenticated attacker able to provide XML for transformation as a Source could read local files or trigger internal-network requests; Apache recommended upgrading to 3.33.3 or 3.40.0.
Commit 9dd1177 extended the Xalan transformer hardening to disable external parameter entities and external DTD loading, complementing the existing block on external general entities. Tests verified that external DTDs and parameter entities could not inject data into transformation results.
James Netherton opened issue #9115, identifying that the XSLT extension's custom TransformerFactory did not inherit Apache Camel's restrictions on external DTD and stylesheet access. The issue proposed applying equivalent restrictions within the extension.
Apache Camel Quarkus backported the XSLT external-entity and resource-access fixes to the 3.33.x branch in commits ad9c52365dc85eac029e8bfe3899aee07e48a525 and 3d8867697c105c0d648fdcfe07f8dd7159cb3d47.
Apache Camel Quarkus updated its XSLT extension to prevent external general-entity resolution in XML parsed during transformations and to deny XSLT document() retrieval unless an application-provided URIResolver permits it. The changes compensate for Xalan-J 2.7.x not honoring JAXP external-access controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceopenwall.com
Open sourcecamel.apache.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical XML External Entity (XXE) injection vulnerability, tracked as CVE-2025-68493, has been identified in the XWork component of Apache Struts 2. This flaw allows attackers to exploit improper XML input validation, potentially leading to sensitive data disclosure, server-side request forgery (SSRF), and denial-of-service (DoS) attacks. The vulnerability affects a wide range of Struts 2 versions, including 2.0.0–2.3.37, 2.5.0–2.5.33, and 6.0.0–6.1.0, exposing millions of applications to risk. Security researchers at ZAST.AI reported the issue, and Apache has rated the vulnerability as 'Important' due to its significant impact on data confidentiality and system availability. Organizations using affected versions are strongly advised to upgrade to Struts 6.1.1, which addresses the vulnerability. The issue is remotely exploitable and has been assigned a CVSS 3.1 score of 8.1 (High). Immediate patching is recommended to prevent exploitation, as attackers can leverage this flaw to extract configuration files, database credentials, and other sensitive information from vulnerable servers. The vulnerability has been confirmed by both independent security researchers and the Apache security team.
Jun 29, 2026
**CVE-2014-0107** affects Xalan-Java's XSLT secure-processing feature: insufficient restrictions on specified properties and features let an attacker supplying malicious XSLT bypass intended processing safeguards. Where suitable components are available on the application classpath, exploitation can lead to arbitrary remote code execution in the application server context. Red Hat rated the flaw Important, with a CVSS v2 score of 6.8, and issued fixes for affected Red Hat Enterprise Linux, JBoss, and Fuse products. Red Hat also included the Xalan-Java issue in **RHSA-2015:1888** for JBoss SOA Platform 5.3.1, alongside certificate hostname-validation, XML deserialization, XXE, and authentication-related flaws. Organizations running affected JBoss deployments should apply the vendor update after backing up installations and stopping the JBoss Application Server; the vulnerability reflects an improperly implemented required security check, allowing secure-processing controls to be circumvented.
Aug 29, 2026
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026