CVE-2026-17615

CVE-2026-17615 is an XML External Entity (XXE, CWE-611) vulnerability in the SourceProvider component of RESTEasy, the JAX-RS implementation maintained by Red Hat: the SourceProvider.writeTo() method creates a SAXParser without disabling external entity resolution. An unauthenticated attacker triggers it by sending an XML body with a DOCTYPE declaration referencing external entities to any endpoint that accepts application/xml and returns a Source or StreamSource, causing the server's parser to resolve the attacker-controlled entity. The attacker gains an unauthenticated remote file read: the parser fetches the referenced resource (a local file path or URL) and the resolved contents are included in the HTTP response, potentially exposing application configuration, credentials, or other sensitive files, with SSRF-style probing of internal URLs also possible; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network reachability with confidentiality-only impact. Affected are deployments of RESTEasy (including RESTEasy embedded in JBoss/WildFly-based Java applications) that expose endpoints matching this pattern; no specific affected or fixed version ranges were provided in the source data. There is currently no known public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a ~0.5% probability of exploitation within 30 days, so no in-the-wild exploitation is known.

What to do: Inventory Java applications running RESTEasy for JAX-RS resources that accept application/xml and return javax.xml.transform.Source/StreamSource, and upgrade RESTEasy to the fixed release published by Red Hat (no version numbers were available in the source data, so track Red Hat security advisories for the fixed packages). As interim mitigation, disable DTDs and external entities in the parsing path (e.g., set SAX features such as disallow-doctype-decl=true and external-general-entities=false) or change affected endpoints to avoid returning Source/StreamSource, and restrict network access to them. Because exploitation is not yet observed but the flaw is trivially triggerable where exposed, prioritize internet-facing endpoints.