org.apache.camel:camel-fop vulnerabilities

CVEs whose affected-version data names the org.apache.camel:camel-fop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-91858Medium· 6.5

today

Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over t…

▾ SunlitApache Software Foundation · org.apache.camel:camel-fopvia CVEORG