CVE-2026-17615
Received Received - Intake

XXE Vulnerability in RESTEasy SourceProvider

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: redhat-SADP

Description
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-17615
EUVD
EUVD-2026-68654

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat resteasy *
red_hat resteasy_core *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider component. An unauthenticated attacker can send a crafted XML payload with a DOCTYPE declaration referencing external entities to an endpoint accepting application/xml. The server's SourceProvider.writeTo() method uses a SAXParser without disabling external entity resolution, allowing the attacker to read sensitive files on the server through the HTTP response.

Detection Guidance

To detect this vulnerability, monitor network traffic for XML payloads with DOCTYPE declarations or external entity references sent to RESTEasy endpoints. Check server logs for unusual file read attempts or responses containing sensitive file contents. Use tools like curl to test endpoints with crafted XML payloads.

Impact Analysis

This vulnerability allows attackers to remotely read sensitive files on the server without authentication. If exploited, it could expose confidential data such as configuration files, user credentials, or other sensitive information stored on the system. The impact includes unauthorized data access and potential further attacks if the exposed files contain exploitable information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR and HIPAA. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. Exploitation of this flaw may result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately restrict access to RESTEasy endpoints that accept XML input and return Source or StreamSource types. Apply patches or updates from Red Hat once available. Implement a custom MessageBodyWriter for Source types that disables external entity resolution in the SAXParserFactory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart