High severityNVD Advisory· Published Mar 21, 2014· Updated May 6, 2026

CVE-2014-0002

Description

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.camel:camel-coreMaven	< 2.11.4	2.11.4
org.apache.camel:camel-coreMaven	>= 2.12.0, < 2.12.3	2.12.3

Affected products

ghsa-coords
pkg:maven/org.apache.camel/camel-core
Range: < 2.11.4

Patches

54b65c1d3084

CAMEL-7129: Remove the CamelXsltResourceUri header from xslt component

https://github.com/apache/camelWillem JiangJan 13, 2014via ghsa

commit

3 files changed · +9 −14

camel-core/src/main/java/org/apache/camel/component/xslt/XsltConstants.java+3 −0 modified

@@ -21,6 +21,9 @@
  */
 public final class XsltConstants {
 
+    @Deprecated 
+    // XsltComponent don't support this message any more
+    // Please create the XsltEndpoint directly from the URI
     public static final String XSLT_RESOURCE_URI = "CamelXsltResourceUri";
 
     private XsltConstants() {

camel-core/src/main/java/org/apache/camel/component/xslt/XsltEndpoint.java+4 −11 modified

@@ -76,19 +76,12 @@ public XsltEndpoint findOrCreateEndpoint(String uri, String newResourceUri) {
 
     @Override
     protected void onExchange(Exchange exchange) throws Exception {
-        String newResourceUri = exchange.getIn().getHeader(XsltConstants.XSLT_RESOURCE_URI, String.class);
-        if (newResourceUri != null) {
-            exchange.getIn().removeHeader(XsltConstants.XSLT_RESOURCE_URI);
 
-            LOG.trace("{} set to {} creating new endpoint to handle exchange", XsltConstants.XSLT_RESOURCE_URI, newResourceUri);
-            XsltEndpoint newEndpoint = findOrCreateEndpoint(getEndpointUri(), newResourceUri);
-            newEndpoint.onExchange(exchange);
-        } else {
-            if (!cacheStylesheet || cacheCleared) {
-                loadResource(resourceUri);
-            }
-            super.onExchange(exchange);
+        if (!cacheStylesheet || cacheCleared) {
+            loadResource(resourceUri);
         }
+        super.onExchange(exchange);
+
     }
 
     /**

camel-core/src/test/java/org/apache/camel/component/xslt/XsltFromHeaderOverrideEndpointUriTest.java+2 −3 modified

@@ -23,10 +23,9 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.impl.JndiRegistry;
+import org.junit.Ignore;
 
-/**
- *
- */
+@Ignore("CamelXsltComponent don't support XSLT_RESOURCE_URI header anymore")
 public class XsltFromHeaderOverrideEndpointUriTest extends ContextTestSupport {
 
     public void testSendMessageAndHaveItTransformed() throws Exception {

2ec54fa0c13a

CAMEL-7129: Remove the CamelXsltResourceUri header from xslt component

https://github.com/apache/camelWillem JiangJan 13, 2014via ghsa

commit

3 files changed · +9 −14

camel-core/src/main/java/org/apache/camel/component/xslt/XsltConstants.java+3 −0 modified

@@ -21,6 +21,9 @@
  */
 public final class XsltConstants {
 
+    @Deprecated 
+    // XsltComponent don't support this message any more
+    // Please create the XsltEndpoint directly from the URI
     public static final String XSLT_RESOURCE_URI = "CamelXsltResourceUri";
 
     private XsltConstants() {

camel-core/src/main/java/org/apache/camel/component/xslt/XsltEndpoint.java+4 −11 modified

@@ -76,19 +76,12 @@ public XsltEndpoint findOrCreateEndpoint(String uri, String newResourceUri) {
 
     @Override
     protected void onExchange(Exchange exchange) throws Exception {
-        String newResourceUri = exchange.getIn().getHeader(XsltConstants.XSLT_RESOURCE_URI, String.class);
-        if (newResourceUri != null) {
-            exchange.getIn().removeHeader(XsltConstants.XSLT_RESOURCE_URI);
 
-            LOG.trace("{} set to {} creating new endpoint to handle exchange", XsltConstants.XSLT_RESOURCE_URI, newResourceUri);
-            XsltEndpoint newEndpoint = findOrCreateEndpoint(getEndpointUri(), newResourceUri);
-            newEndpoint.onExchange(exchange);
-        } else {
-            if (!cacheStylesheet || cacheCleared) {
-                loadResource(resourceUri);
-            }
-            super.onExchange(exchange);
+        if (!cacheStylesheet || cacheCleared) {
+            loadResource(resourceUri);
         }
+        super.onExchange(exchange);
+
     }
 
     /**

camel-core/src/test/java/org/apache/camel/component/xslt/XsltFromHeaderOverrideEndpointUriTest.java+2 −3 modified

@@ -23,10 +23,9 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.impl.JndiRegistry;
+import org.junit.Ignore;
 
-/**
- *
- */
+@Ignore("CamelXsltComponent don't support XSLT_RESOURCE_URI header anymore")
 public class XsltFromHeaderOverrideEndpointUriTest extends ContextTestSupport {
 
     public void testSendMessageAndHaveItTransformed() throws Exception {

341d4e6cca71

CAMEL-7129: Remove the CamelXsltResourceUri header from xslt component

https://github.com/apache/camelWillem JiangJan 13, 2014via ghsa

commit

3 files changed · +9 −14

camel-core/src/main/java/org/apache/camel/component/xslt/XsltConstants.java+3 −0 modified

@@ -21,6 +21,9 @@
  */
 public final class XsltConstants {
 
+    @Deprecated 
+    // XsltComponent don't support this message any more
+    // Please create the XsltEndpoint directly from the URI
     public static final String XSLT_RESOURCE_URI = "CamelXsltResourceUri";
 
     private XsltConstants() {

camel-core/src/main/java/org/apache/camel/component/xslt/XsltEndpoint.java+4 −11 modified

@@ -81,19 +81,12 @@ public XsltEndpoint findOrCreateEndpoint(String uri, String newResourceUri) {
 
     @Override
     protected void onExchange(Exchange exchange) throws Exception {
-        String newResourceUri = exchange.getIn().getHeader(XsltConstants.XSLT_RESOURCE_URI, String.class);
-        if (newResourceUri != null) {
-            exchange.getIn().removeHeader(XsltConstants.XSLT_RESOURCE_URI);
 
-            LOG.trace("{} set to {} creating new endpoint to handle exchange", XsltConstants.XSLT_RESOURCE_URI, newResourceUri);
-            XsltEndpoint newEndpoint = findOrCreateEndpoint(getEndpointUri(), newResourceUri);
-            newEndpoint.onExchange(exchange);
-        } else {
-            if (!cacheStylesheet || cacheCleared) {
-                loadResource(resourceUri);
-            }
-            super.onExchange(exchange);
+        if (!cacheStylesheet || cacheCleared) {
+            loadResource(resourceUri);
         }
+        super.onExchange(exchange);
+
     }
 
     /**

camel-core/src/test/java/org/apache/camel/component/xslt/XsltFromHeaderOverrideEndpointUriTest.java+2 −3 modified

@@ -23,10 +23,9 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.impl.JndiRegistry;
+import org.junit.Ignore;
 
-/**
- *
- */
+@Ignore("CamelXsltComponent don't support XSLT_RESOURCE_URI header anymore")
 public class XsltFromHeaderOverrideEndpointUriTest extends ContextTestSupport {
 
     public void testSendMessageAndHaveItTransformed() throws Exception {

54b65c1d3084

CAMEL-7129: Remove the CamelXsltResourceUri header from xslt component

https://github.com/apache/camelWillem JiangJan 13, 2014via ghsa

commit

3 files changed · +9 −14

camel-core/src/main/java/org/apache/camel/component/xslt/XsltConstants.java+3 −0 modified

@@ -21,6 +21,9 @@
  */
 public final class XsltConstants {
 
+    @Deprecated 
+    // XsltComponent don't support this message any more
+    // Please create the XsltEndpoint directly from the URI
     public static final String XSLT_RESOURCE_URI = "CamelXsltResourceUri";
 
     private XsltConstants() {

camel-core/src/main/java/org/apache/camel/component/xslt/XsltEndpoint.java+4 −11 modified

@@ -76,19 +76,12 @@ public XsltEndpoint findOrCreateEndpoint(String uri, String newResourceUri) {
 
     @Override
     protected void onExchange(Exchange exchange) throws Exception {
-        String newResourceUri = exchange.getIn().getHeader(XsltConstants.XSLT_RESOURCE_URI, String.class);
-        if (newResourceUri != null) {
-            exchange.getIn().removeHeader(XsltConstants.XSLT_RESOURCE_URI);
 
-            LOG.trace("{} set to {} creating new endpoint to handle exchange", XsltConstants.XSLT_RESOURCE_URI, newResourceUri);
-            XsltEndpoint newEndpoint = findOrCreateEndpoint(getEndpointUri(), newResourceUri);
-            newEndpoint.onExchange(exchange);
-        } else {
-            if (!cacheStylesheet || cacheCleared) {
-                loadResource(resourceUri);
-            }
-            super.onExchange(exchange);
+        if (!cacheStylesheet || cacheCleared) {
+            loadResource(resourceUri);
         }
+        super.onExchange(exchange);
+
     }
 
     /**

camel-core/src/test/java/org/apache/camel/component/xslt/XsltFromHeaderOverrideEndpointUriTest.java+2 −3 modified

@@ -23,10 +23,9 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.impl.JndiRegistry;
+import org.junit.Ignore;
 
-/**
- *
- */
+@Ignore("CamelXsltComponent don't support XSLT_RESOURCE_URI header anymore")
 public class XsltFromHeaderOverrideEndpointUriTest extends ContextTestSupport {
 
     public void testSendMessageAndHaveItTransformed() throws Exception {

2ec54fa0c13a

CAMEL-7129: Remove the CamelXsltResourceUri header from xslt component

https://github.com/apache/camelWillem JiangJan 13, 2014via ghsa

commit

3 files changed · +9 −14

camel-core/src/main/java/org/apache/camel/component/xslt/XsltConstants.java+3 −0 modified

@@ -21,6 +21,9 @@
  */
 public final class XsltConstants {
 
+    @Deprecated 
+    // XsltComponent don't support this message any more
+    // Please create the XsltEndpoint directly from the URI
     public static final String XSLT_RESOURCE_URI = "CamelXsltResourceUri";
 
     private XsltConstants() {

camel-core/src/main/java/org/apache/camel/component/xslt/XsltEndpoint.java+4 −11 modified

@@ -76,19 +76,12 @@ public XsltEndpoint findOrCreateEndpoint(String uri, String newResourceUri) {
 
     @Override
     protected void onExchange(Exchange exchange) throws Exception {
-        String newResourceUri = exchange.getIn().getHeader(XsltConstants.XSLT_RESOURCE_URI, String.class);
-        if (newResourceUri != null) {
-            exchange.getIn().removeHeader(XsltConstants.XSLT_RESOURCE_URI);
 
-            LOG.trace("{} set to {} creating new endpoint to handle exchange", XsltConstants.XSLT_RESOURCE_URI, newResourceUri);
-            XsltEndpoint newEndpoint = findOrCreateEndpoint(getEndpointUri(), newResourceUri);
-            newEndpoint.onExchange(exchange);
-        } else {
-            if (!cacheStylesheet || cacheCleared) {
-                loadResource(resourceUri);
-            }
-            super.onExchange(exchange);
+        if (!cacheStylesheet || cacheCleared) {
+            loadResource(resourceUri);
         }
+        super.onExchange(exchange);
+
     }
 
     /**

camel-core/src/test/java/org/apache/camel/component/xslt/XsltFromHeaderOverrideEndpointUriTest.java+2 −3 modified

@@ -23,10 +23,9 @@
 import org.apache.camel.builder.RouteBuilder;
 import org.apache.camel.component.mock.MockEndpoint;
 import org.apache.camel.impl.JndiRegistry;
+import org.junit.Ignore;
 
-/**
- *
- */
+@Ignore("CamelXsltComponent don't support XSLT_RESOURCE_URI header anymore")
 public class XsltFromHeaderOverrideEndpointUriTest extends ContextTestSupport {
 
     public void testSendMessageAndHaveItTransformed() throws Exception {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.023
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000