CVE-2026-17615

Name of the Vulnerable Software and Affected Versions RESTEasy (affected versions not specified)

Description A flaw in the SourceProvider allows an unauthenticated attacker to perform a remote file read. By sending a specially crafted XML body containing a DOCTYPE declaration that references external entities to an endpoint accepting application/xml and returning Source or StreamSource, the server may resolve the entity and include sensitive file contents in the HTTP response. This occurs because the writeTo() function creates a SAXParser without disabling external entity resolution, resulting in an XML External Entity (XXE) vulnerability—a type of attack that interferes with an application's processing of XML data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.