Skip to content
Fencer Vulns
high 7.5

CVE-2026-17615 json

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

published 2026-08-31 2 mo ago modified 2026-11-06 2 d ago also EUVD-2026-68654

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

Patch / fix

  • Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 6.2.16.Final-redhat-00003
  • Red Hat Red Hat build of Keycloak 26.6 26.6-20, 26.6.7-3
  • Red Hat Red Hat build of Quarkus 3.27.5.SP1 6.2.12.Final-redhat-00003
  • Red Hat Red Hat build of Quarkus 3.33.3.SP1 6.2.16.Final-redhat-00003
  • Red Hat Red Hat Enterprise Linux 9 0:3.0.26-20.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.0.26-16.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.0.26-20.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.0.26-20.el9_6
  • resteasy RHEL 9 3.0.26-20.el9_8
  • pki-resteasy-core RHEL 9 3.0.26-20.el9_8
  • pki-resteasy-client RHEL 9 3.0.26-20.el9_8
  • pki-resteasy-jackson2-provider RHEL 9 3.0.26-20.el9_8
  • pki-resteasy-servlet-initializer RHEL 9 3.0.26-20.el9_8
  • resteasy RHEL 9.4 E4S 3.0.26-20.el9_4
  • pki-resteasy-core RHEL 9.4 E4S 3.0.26-20.el9_4
  • pki-resteasy-client RHEL 9.4 E4S 3.0.26-20.el9_4

red hat advisories RHSA-2026:80505RHSA-2026:77297RHSA-2026:72424

  • pki-resteasy-core AlmaLinux 9 3.0.26-20.el9_8
  • pki-resteasy-client AlmaLinux 9 3.0.26-20.el9_8
  • pki-resteasy-jackson2-provider AlmaLinux 9 3.0.26-20.el9_8
  • pki-resteasy-servlet-initializer AlmaLinux 9 3.0.26-20.el9_8

almalinux advisories ALSA-2026:72424

  • resteasy Rocky Linux 9 3.0.26-20.el9_8

rocky linux advisories RLSA-2026:72424

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-17615 updated cvss 7.5

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

  • Red Hat build of Apache Camel 4 for Quarkus 3 resteasy-core Red Hat build of Apicurio Registry 3 resteasy-core Red Hat build of Debezium 3 resteasy-core
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack resteasy-core
    affected: workaround, no fix available
  • Red Hat Build of Apache Camel 3.33.3.SP1 resteasy-core 6.2.16.Final-redhat-00003
    fixed: vendor fix RHSA-2026:63302
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-20, rhbk/keycloak-rhel9-operator 26.6-20, rhbk/keycloak-operator-bundle 26.6.7-3
    fixed: vendor fix RHSA-2026:68277
  • Red Hat build of Keycloak 26.6.7
    fixed: vendor fix RHSA-2026:68278
  • Red Hat build of Quarkus 3.27.5.SP1 resteasy-core 6.2.12.Final-redhat-00003
    fixed: vendor fix RHSA-2026:62515
  • Red Hat build of Quarkus 3.33.3.SP1 resteasy-core 6.2.16.Final-redhat-00003
    fixed: vendor fix RHSA-2026:62555
show 7 more
  • Red Hat Enterprise Linux AppStream (v. 9) resteasy 3.0.26-20.el9_8, pki-resteasy-core 3.0.26-20.el9_8, pki-resteasy-client 3.0.26-20.el9_8, pki-resteasy-jackson2-provider 3.0.26-20.el9_8, pki-resteasy-servlet-initializer 3.0.26-20.el9_8
    fixed: vendor fix RHSA-2026:72424
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) resteasy 3.0.26-16.el9_2, pki-resteasy-core 3.0.26-16.el9_2, pki-resteasy-client 3.0.26-16.el9_2, pki-resteasy-jackson2-provider 3.0.26-16.el9_2
    fixed: vendor fix RHSA-2026:90894
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) resteasy 3.0.26-20.el9_4, pki-resteasy-core 3.0.26-20.el9_4, pki-resteasy-client 3.0.26-20.el9_4, pki-resteasy-jackson2-provider 3.0.26-20.el9_4, pki-resteasy-servlet-initializer 3.0.26-20.el9_4
    fixed: vendor fix RHSA-2026:80505
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) resteasy 3.0.26-20.el9_6, pki-resteasy-core 3.0.26-20.el9_6, pki-resteasy-client 3.0.26-20.el9_6, pki-resteasy-jackson2-provider 3.0.26-20.el9_6, pki-resteasy-servlet-initializer 3.0.26-20.el9_6
    fixed: vendor fix RHSA-2026:77297
  • Red Hat JBoss Enterprise Application Platform 8.1
    fixed: vendor fix RHSA-2026:95221
  • Red Hat Build of Apache Camel 3.33.3.SP1 jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1618 more Red Hat build of Quarkus 3.27.5.SP1 jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.3.SP1 jna 5.8.0, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, wasm 2.15.3, +1018 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Fuse 7 resteasy-core Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat Red Hat build of Keycloak 26.6
  • Red Hat Red Hat build of Keycloak 26.6.7
  • Red Hat Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat Red Hat build of Quarkus 3.33.3.SP1
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Satellite 6

Classification

Weakness
  • CWE-611 Improper Restriction of XML External Entity Reference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.