CVE-2026-17615

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 31, 2026
Source updated: Oct 20, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Red Hat Build of Apache Camel 3.33.3.SP1

Vendor: Red Hat
Product: Red Hat Build of Apache Camel 3.33.3.SP1
Platforms: Unknown
Default status: affected
Package: org.jboss.resteasy/resteasy-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Build of Apache Camel 3.33.3.SP1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.2.16.Final-redhat-00003	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.6

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.6.7-3	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.6

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.6-20	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.6

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 26.6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
26.6-20	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 26.6.7

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6.7
Platforms: Unknown
Default status: unaffected
Package: keycloak/rhbk-rhel9-operator
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.6.7

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6.7
Platforms: Unknown
Default status: unaffected
Package: resteasy-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.6.7

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6.7
Platforms: Unknown
Default status: unaffected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.6.7

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6.7
Platforms: Unknown
Default status: unaffected
Package: rhbk-keycloak-rhel9-operator/rhbk-keycloak-rhel9-operator
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 26.6.7

Vendor: Red Hat
Product: Red Hat build of Keycloak 26.6.7
Platforms: Unknown
Default status: unaffected
Package: rhbk-rhel9-operator/rhbk-rhel9-operator
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus 3.27.5.SP1

Vendor: Red Hat
Product: Red Hat build of Quarkus 3.27.5.SP1
Platforms: Unknown
Default status: affected
Package: org.jboss.resteasy/resteasy-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Red Hat build of Quarkus 3.27.5.SP1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.2.12.Final-redhat-00003	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Quarkus 3.33.3.SP1

Vendor: Red Hat
Product: Red Hat build of Quarkus 3.33.3.SP1
Platforms: Unknown
Default status: affected
Package: org.jboss.resteasy/resteasy-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Red Hat build of Quarkus 3.33.3.SP1 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.2.16.Final-redhat-00003	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Enterprise Linux 9

Vendor: Red Hat
Product: Red Hat Enterprise Linux 9
Platforms: Unknown
Default status: affected
Package: resteasy
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Enterprise Linux 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.0.26-20.el9_8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Vendor: Red Hat
Product: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Platforms: Unknown
Default status: affected
Package: resteasy
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.0.26-20.el9_4	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Enterprise Linux 9.6 Extended Update Support

Vendor: Red Hat
Product: Red Hat Enterprise Linux 9.6 Extended Update Support
Platforms: Unknown
Default status: affected
Package: resteasy
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Enterprise Linux 9.6 Extended Update Support · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.0.26-20.el9_6	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Apache Camel 4 for Quarkus 3

Vendor: Red Hat
Product: Red Hat build of Apache Camel 4 for Quarkus 3
Platforms: Unknown
Default status: affected
Package: resteasy-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Apicurio Registry 3

Vendor: Red Hat
Product: Red Hat build of Apicurio Registry 3
Platforms: Unknown
Default status: affected
Package: resteasy-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Debezium 3

Vendor: Red Hat
Product: Red Hat build of Debezium 3
Platforms: Unknown
Default status: affected
Package: resteasy-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Enterprise Linux 8

Vendor: Red Hat
Product: Red Hat Enterprise Linux 8
Platforms: Unknown
Default status: affected
Package: pki-core:10.6/resteasy
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Enterprise Linux 8

Vendor: Red Hat
Product: Red Hat Enterprise Linux 8
Platforms: Unknown
Default status: unaffected
Package: pki-deps:10.6/resteasy
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Fuse 7

Vendor: Red Hat
Product: Red Hat Fuse 7
Platforms: Unknown
Default status: unaffected
Package: resteasy-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8
Platforms: Unknown
Default status: affected
Package: resteasy-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform Expansion Pack

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform Expansion Pack
Platforms: Unknown
Default status: affected
Package: resteasy-core
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat Satellite 6

Vendor: Red Hat
Product: Red Hat Satellite 6
Platforms: Unknown
Default status: unaffected
Package: candlepin
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.