CVE-2026-17615

NameCVE-2026-17615
DescriptionA flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
resteasy (PTS)sid3.6.2-4vulnerable
resteasy3.0 (PTS)forky, sid, bookworm, trixie3.0.26-6vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
resteasysource(unstable)(unfixed)
resteasy3.0source(unstable)(unfixed)

Notes

[trixie] - resteasy3.0 <ignored> (Minor issue, no reverse deps in Trixie)
https://bugzilla.redhat.com/show_bug.cgi?id=2507635

Search for package or bug name: Reporting problems