Description
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Build of Apache Camel 3.33.3.SP1 | — | — |
| Red Hat | Red Hat build of Keycloak 26.6 | — | — |
| Red Hat | Red Hat build of Keycloak 26.6.7 | — | — |
| Red Hat | Red Hat build of Quarkus 3.27.5.SP1 | — | — |
| Red Hat | Red Hat build of Quarkus 3.33.3.SP1 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | — | — |
| Red Hat | Red Hat build of Debezium 3 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | resteasy3.0 | No fix yet | — |
| Debian 13 | resteasy3.0 | No fix yet | — |
| Debian 12 | resteasy3.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | resteasy +1 | No fix yet | — |
| Ubuntu 26.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu 24.04 LTS | resteasy3.0 | No fix yet | — |
| Ubuntu 22.04 LTS | resteasy3.0 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | resteasy | No fix yet | — |
| Ubuntu Pro 22.04 LTS | resteasy | No fix yet | — |
| Ubuntu Pro 20.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | resteasy3.0 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | resteasy | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | resteasy +4 | 3.0.26-20.el9_8 | RHSA-2026:72424 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | resteasy +4 | 3.0.26-20.el9_6 | RHSA-2026:77297 |
| RHEL 9.4 E4S | resteasy +4 | 3.0.26-20.el9_4 | RHSA-2026:80505 |
| RHEL 9.2 E4S | resteasy +3 | 3.0.26-16.el9_2 | RHSA-2026:90894 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | pki-resteasy-core +3 | 3.0.26-20.el9_8 | ALSA-2026:72424 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | resteasy | 3.0.26-20.el9_8 | RLSA-2026:72424 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | resteasy-base +12 | 3.0.6-4.amzn2.0.2 | ALAS2-2026-3936 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | pki-resteasy-core +3 | 3.0.26-20.el9_8 | ELSA-2026-72424 |
Advisories 10
- RHSA-2026:90894 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3927 IBM WebSphere Application Server und Liberty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-3814 Red Hat Enterprise Linux (resteasy): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2026:72424 Important: resteasy security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:80505 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:77297 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72424 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:72424 Important: resteasy security update Rocky Linux Security Advisories · Sep 29, 2026
- ALAS2-2026-3936 Important: resteasy-base security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 28, 2026
- ELSA-2026-72424 Important: resteasy security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 28, 2026
References
- RHSA-2026:62515 vendor-advisory
- RHSA-2026:62555 vendor-advisory
- RHSA-2026:63302 vendor-advisory
- RHSA-2026:68277 vendor-advisory
- RHSA-2026:68278 vendor-advisory
- RHSA-2026:72424 vendor-advisory
- RHSA-2026:77297 vendor-advisory
- RHSA-2026:80505 vendor-advisory
- RHSA-2026:90894 vendor-advisory
- RHSA-2026:95221 vendor-advisory
- RHSA-2026:95887 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-17615 vdb-entry
- RHBZ#2507635 issue-tracking