High ELSA-2026-72424 1 CVE

Important: resteasy security update (Oracle Linux 9)

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Oracle Linux

Summary

[3.0.26-20]
- Fix CVE-2026-17615: SourceProvider remote unauthenticated file read
Resolves: RHEL-251553

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 9	pki-resteasy-client	0:3.0.26-20.el9_8
Oracle Linux · 9	pki-resteasy-core	0:3.0.26-20.el9_8
Oracle Linux · 9	pki-resteasy-jackson2-provider	0:3.0.26-20.el9_8
Oracle Linux · 9	pki-resteasy-servlet-initializer	0:3.0.26-20.el9_8

Vulnerabilities 1

High 7.5

CVE-2026-17615

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoin…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Linux Debian Ubuntu

Aug 31, 2026