High 7.5

XXE (XML External Entity) in RESTEasy's SourceProvider

CVE-2026-17615 First seen on SecPulse Sep 1, 02:17

Summary

Vulnerability in RESTEasy's SourceProvider (CVE-2026-17615). Confidential information can be exposed externally.

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

A vulnerability tracked as CVE-2026-17615 has been found in RESTEasy's SourceProvider.
Confidential information can be exposed externally. CVSS score: 7.5/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "RESTEasy's SourceProvider CVE-2026-17615" on the vendor's site.

CVE-2026-17615 (RESTEasy's SourceProvider) — CWE-611 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

What is the problem

A vulnerability (CWE-611) exists in RESTEasy's SourceProvider.

Affected scope

Check the vendor advisory for the affected versions of RESTEasy's SourceProvider.

Severity

Severity: High (CVSS 7.5/10). Confidential information can be exposed externally.

How to fix

Update to the patched release per vendor advisory.

Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposureidentify
```
Audit SBOM/dependencies for affected components.
```
資産台帳・SBOM・依存マニフェストで RESTEasy's SourceProvider を使っているサービスとバージョンを洗い出す。
2
Post-deployment verificationverify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Debian DEBIAN-CVE-2026-17615 resteasy3.0 No fixed version in this record
Ubuntu UBUNTU-CVE-2026-17615 resteasy3.0, resteasy No fixed version in this record

Original description The description as published by the source.

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

Source: NIST National Vulnerability Database NVD GitHub Advisory

Summary

AI summary

Response actions

Fix status by distribution

References