Skip to content
fr Sign in
7.5 High

CVE-2026-17615 Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Description

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Show the 12 other branches
Product Affected versions Fixed in
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1 Versions not published
Red Hat build of Keycloak 26.6 26.6 earliest → < 26.6-20 26.6-20
Red Hat build of Keycloak 26.6.7 Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat build of Quarkus 3.27.5.SP1 6.2 earliest → < 6.2.12.Final-redhat-00003 6.2.12.Final-redhat-00003
Red Hat build of Quarkus 3.33.3.SP1 6.2 earliest → < 6.2.16.Final-redhat-00003 6.2.16.Final-redhat-00003
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Versions not published
Red Hat Build of Apache Camel 3.33.3.SP1 6.2 earliest → < 6.2.16.Final-redhat-00003 6.2.16.Final-redhat-00003
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Apache Camel 4 for Quarkus 3

The 75 CVEs of Red Hat build of Apache Camel 4 for Quarkus 3 →
CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120971 A flaw was found in RESTEasy's default exception mapper 5.3 Medium CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan 4.3 Medium CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service 7.5 High
Track this CVE