{"metadata": {"vulnerability": "CVE-2026-85250", "count": 16, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-03T16:29:17.101Z", "date_only": false, "value": "2026-09-03T16:29:17.101Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T10:35:21.670Z", "date_only": false, "value": "2026-10-19T10:35:21.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-19T10:35:21.670Z", "date_only": false, "value": "2026-10-19T10:35:21.670Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-85250", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:50:19.569Z", "date_only": false, "value": "2026-10-19T10:50:19.569898Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117467186396958765", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "de1515ab-c4bf-4f38-a8f6-503c71d468f8", "content": "CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\nWith documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder of its own using the JDK defaults. The hardening applied to Camel's default document type was therefore bypassed: a DOCTYPE declaration that is refused on the default type was accepted here, and the external entity it declared was resolved and expanded into the evaluated document. An external sender whose XML reaches such an expression could read files readable by the Camel process and cause the process to issue requests to hosts it names. The two document types disagreeing on parser configuration is what made this reachable, since a deployment choosing InputSource for streaming reasons had no indication it was also choosing a weaker parser.\nUpgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. The InputSource document type now goes through the same hardened parser as the default type, so a DOCTYPE is refused. Note that it also shares that type's documented escape hatch: the same DocumentBuilderFactory system properties that relax the default type relax this one, so a deployment that has set them remains unprotected by design. For deployments that cannot upgrade immediately, do not use documentType=InputSource on expressions evaluated over untrusted XML; the default document type already refuses a DOCTYPE.\nhttps://www.cve.org/CVERecord?id=CVE-2026-85250https://camel.apache.org/security/CVE-2026-85250.htmlhttps://issues.apache.org/jira/browse/CAMEL-24475https://github.com/apache/camel/pull/25683https://github.com/apache/camel/pull/25940https://github.com/apache/camel/pull/25942#apache #ApacheSoftwareFoundation #ApacheCamel#CVE_2026_85250#bot", "url": "https://infosec.exchange/users/cve/statuses/117467186396958765"}, {"timestamp": "2026-10-19T11:17:23Z", "date_only": false, "value": "2026-10-19T11:17:23Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X9F8-58M2-93Q2", "record": "GHSA-X9F8-58M2-93Q2", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-19T11:17:23.257Z", "date_only": false, "value": "2026-10-19T11:17:23.257", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85250", "record": "FKIE_CVE-2026-85250", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-19T12:32:51Z", "date_only": false, "value": "2026-10-19T12:32:51Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X9F8-58M2-93Q2", "record": "GHSA-X9F8-58M2-93Q2", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-19T12:32:51Z", "date_only": false, "value": "2026-10-19T12:32:51Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X9F8-58M2-93Q2", "record": "GHSA-X9F8-58M2-93Q2", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-19T15:00:20Z", "date_only": false, "value": "2026-10-19T15:00:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7W3B6AmrElLxRkHcXruehxeONTAJ3TALBGj9-MDAxUEfiWA", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "72c129bf-a139-49d2-af69-3a5e14e4e98c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-19T15:00:20Z", "date_only": false, "value": "2026-10-19T15:00:20.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/7W3B6AmrElLxRkHcXruehxeONTAJ3TALBGj9-MDAxUEfiWA", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "5271dd36-f916-4c44-b560-3e6b80c78fe7"}, {"timestamp": "2026-10-19T16:50:01.891Z", "date_only": false, "value": "2026-10-19T16:50:01.891861Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85250", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T16:50:01.891Z", "date_only": false, "value": "2026-10-19T16:50:01.891861Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85250", "record": "FKIE_CVE-2026-85250", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-19T16:50:38.120Z", "date_only": false, "value": "2026-10-19T16:50:38.120Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T16:50:38.120Z", "date_only": false, "value": "2026-10-19T16:50:38.120Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85250", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T15:14:18.307Z", "date_only": false, "value": "2026-10-26T15:14:18.307959Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117507860553722333", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "9066a7c1-a2e2-47fa-a891-33191d8505d3", "content": "CVE-2026-90885 Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2.\nXQueryBuilder in camel-saxon, which evaluates expressions for the xquery language and the xquery component, built its default Saxon Configuration with parse options that set only a whitespace stripping rule, leaving the XML parser at its defaults, under which a DOCTYPE declaration is accepted and external entities are resolved. A message body of type String or byte[], or any body read as an InputStream, is first turned into a javax.xml.transform.Source by Camel's own XML type converters, which configure the parser against external entities, so those bodies were not affected. A body that was already a Source, however, was handed to Saxon unchanged, and when that Source still had to be parsed, as a stream-based Source does, Saxon parsed it with that Configuration, bypassing the protection applied to the other body types. Such a body arises, for example, after a route converts the message with convertBodyTo(Source.class), or when a component or processor earlier in the route sets the body to a stream-based Source. A DOCTYPE with an external subset, or an external entity, declared in that body was therefore resolved and expanded into the document the expression was evaluated against. An external sender whose XML reaches an XQuery expression or an xquery endpoint in that form could read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since the default Configuration is used whenever the route does not supply one of its own.\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier, as well as the 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines, reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not evaluate XQuery over a message body that is already a javax.xml.transform.Source when that body carries XML from an untrusted sender, or set the configuration option of the xquery endpoint or language to a Saxon Configuration whose parse options refuse a DOCTYPE declaration and disable external entities and external DTD loading, which is what the fixed releases now apply by default.\nhttps://www.cve.org/CVERecord?id=CVE-2026-90885https://camel.apache.org/security/CVE-2026-90885.htmlhttps://issues.apache.org/jira/browse/CAMEL-24691https://github.com/apache/camel/pull/26344https://github.com/apache/camel/pull/26728https://github.com/apache/camel/pull/26730https://camel.apache.org/security/CVE-2026-85250.html#apache #ApacheSoftwareFoundation #ApacheCamel#CVE_2026_90885#bot", "url": "https://infosec.exchange/users/cve/statuses/117507860553722333"}, {"timestamp": "2026-11-03T21:35:34.193Z", "date_only": false, "value": "2026-11-03T21:35:34.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85250", "record": "FKIE_CVE-2026-85250", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T11:38:53.085Z", "anchors": {"origin": {"timestamp": "2026-10-19T10:35:21.670Z", "date_only": false, "value": "2026-10-19T10:35:21.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-19T10:35:21.670Z", "date_only": false, "value": "2026-10-19T10:35:21.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-19T15:00:20Z", "date_only": false, "value": "2026-10-19T15:00:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7W3B6AmrElLxRkHcXruehxeONTAJ3TALBGj9-MDAxUEfiWA", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "72c129bf-a139-49d2-af69-3a5e14e4e98c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 15898.33, "hours": 4.4162027777777775, "days": 0.18400844907407407, "min_seconds": 15898.33, "max_seconds": 15898.33, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-19T10:35:21.670Z", "date_only": false, "value": "2026-10-19T10:35:21.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-19T15:00:20Z", "date_only": false, "value": "2026-10-19T15:00:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7W3B6AmrElLxRkHcXruehxeONTAJ3TALBGj9-MDAxUEfiWA", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "72c129bf-a139-49d2-af69-3a5e14e4e98c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1472611.415258, "hours": 409.05872646055553, "days": 17.044113602523147, "min_seconds": 1472611.415258, "max_seconds": 1472611.415258, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-19T10:35:21.670Z", "date_only": false, "value": "2026-10-19T10:35:21.670Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85250", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T11:38:53.085Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 1456713.085258, "hours": 404.6425236827778, "days": 16.860105153449076, "min_seconds": 1456713.085258, "max_seconds": 1456713.085258, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-19T15:00:20Z", "date_only": false, "value": "2026-10-19T15:00:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/7W3B6AmrElLxRkHcXruehxeONTAJ3TALBGj9-MDAxUEfiWA", "record": "CVE-2026-85250", "field": "creation_timestamp", "uuid": "72c129bf-a139-49d2-af69-3a5e14e4e98c", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-05T11:38:53.085Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}