XML External Entity Vulnerability in RESTEasy by Red Hat
CVE-2026-17615

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Build Of Apache Camel 3.33.3.sp1; Red Hat Build Of Keycloak 26.6; Red Hat Build Of Keycloak 26.6.7; Red Hat Build Of Quarkus 3.27.5.sp1
Vendor: CVE Published:; 31 August 2026

What is CVE-2026-17615?

A security flaw in RESTEasy's SourceProvider allows unauthenticated attackers to exploit an XML External Entity (XXE) vulnerability. This occurs when a specially crafted XML body containing a DOCTYPE declaration that references external entities is sent to a susceptible endpoint. The flaw arises from the SourceProvider.writeTo() method, which initializes a SAXParser without disabling the resolution of external entities. Consequently, the server may unwittingly expose sensitive file contents in its HTTP response, leading to a potential information disclosure threat.