CVE catalog
CVE-2026-17615
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCT
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.82% · Oct 25, 2026
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | resteasy3.0 | sid | 3.0.26-6 | vulnerable |
| Debian | resteasy3.0 | forky | 3.0.26-6 | vulnerable |
| Debian | resteasy3.0 | trixie | 3.0.26-6 | vulnerable |
| Debian | resteasy3.0 | bookworm | 3.0.26-6 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | resteasy3.0 | source | sid | (unfixed) | not yet assigned | Not reported | [1146754] |
| Debian | resteasy3.0 | source | forky | (unfixed) | not yet assigned | Not reported | [1146754] |
| Debian | resteasy3.0 | source | trixie | (unfixed) | not yet assigned | Not reported | [1146754] |
| Debian | resteasy3.0 | source | bookworm | (unfixed) | not yet assigned | Not reported | [1146754] |
Notes
[trixie] resteasy3.0: Minor issue, no reverse deps in Trixie [bookworm] resteasy3.0: Minor issue, no reverse deps in Trixie
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libresteasy3.0-java]Affected
Source package: [resteasy3.0]
Details (2)
3.0.26-6· all · bookwormAffected
nvd · resteasy3.0 · debian · bookworm; nvd · resteasy3.0 · debian · 12
3.0.26-6· all · bookwormAffected
nvd · resteasy3.0 · debian · bookworm; nvd · resteasy3.0 · debian · 12
[Debian 13 (Trixie)]
- [libresteasy3.0-java]Affected
Source package: [resteasy3.0]
Details (2)
3.0.26-6· all · trixieAffected
nvd · resteasy3.0 · debian · 13
3.0.26-6· all · trixieAffected
nvd · resteasy3.0 · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_72424.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-17615]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-17615]
- [https://security-tracker.debian.org/tracker/CVE-2026-17615]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-17615.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3814.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]