CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read
Unauthenticated attackers can read sensitive files via XML External Entity injection in RESTEasy's SourceProvider when handling XML requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-17615?
CVE-2026-17615 is a high-severity vulnerability in Red Hat Build of Apache Camel 3.33.3.SP1, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
Weakness: CWE-611
Which versions are affected by CVE-2026-17615?
Linux distribution packages (20)
pki-resteasy-client AlmaLinux:9 | All versions | 3.0.26-20.el9_8 |
pki-resteasy-core AlmaLinux:9 | All versions | 3.0.26-20.el9_8 |
pki-resteasy-jackson2-provider AlmaLinux:9 | All versions | 3.0.26-20.el9_8 |
pki-resteasy-servlet-initializer AlmaLinux:9 | All versions | 3.0.26-20.el9_8 |
pki-resteasy-client Red Hat:enterprise_linux:9::appstream | All versions | 0:3.0.26-20.el9_8 |
pki-resteasy-core Red Hat:enterprise_linux:9::appstream | All versions | 0:3.0.26-20.el9_8 |
pki-resteasy-jackson2-provider Red Hat:enterprise_linux:9::appstream | All versions | 0:3.0.26-20.el9_8 |
pki-resteasy-servlet-initializer Red Hat:enterprise_linux:9::appstream | All versions | 0:3.0.26-20.el9_8 |
resteasy Red Hat:enterprise_linux:9::appstream | All versions | 0:3.0.26-20.el9_8 |
pki-resteasy-client Red Hat:rhel_e4s:9.4::appstream | All versions | 0:3.0.26-20.el9_4 |
pki-resteasy-core Red Hat:rhel_e4s:9.4::appstream | All versions | 0:3.0.26-20.el9_4 |
pki-resteasy-jackson2-provider Red Hat:rhel_e4s:9.4::appstream | All versions | 0:3.0.26-20.el9_4 |
pki-resteasy-servlet-initializer Red Hat:rhel_e4s:9.4::appstream | All versions | 0:3.0.26-20.el9_4 |
resteasy Red Hat:rhel_e4s:9.4::appstream | All versions | 0:3.0.26-20.el9_4 |
pki-resteasy-client Red Hat:rhel_eus:9.6::appstream | All versions | 0:3.0.26-20.el9_6 |
pki-resteasy-core Red Hat:rhel_eus:9.6::appstream | All versions | 0:3.0.26-20.el9_6 |
pki-resteasy-jackson2-provider Red Hat:rhel_eus:9.6::appstream | All versions | 0:3.0.26-20.el9_6 |
pki-resteasy-servlet-initializer Red Hat:rhel_eus:9.6::appstream | All versions | 0:3.0.26-20.el9_6 |
resteasy Red Hat:rhel_eus:9.6::appstream | All versions | 0:3.0.26-20.el9_6 |
resteasy Rocky Linux:9 | All versions | 0:3.0.26-20.el9_8 |
How do I fix CVE-2026-17615?
Apply the vendor's patch.
Is CVE-2026-17615 being exploited?
There is no known exploitation of CVE-2026-17615 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:72424, DEBIAN-CVE-2026-17615, GHSA-h82j-45qh-f65r, RHSA-2026:72424, RHSA-2026:77297, RHSA-2026:80505 and 2 more.