# CVE-2026-17615: Red Hat RESTEasy XML External Entity injection in SourceProvider

Source: https://junglewise.ai/threats/cve-2026-17615-red-hat-resteasy-xml-external-entity-injection-in-sourceprovider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17615 · Severity: high · CVSS 7.5 · Published 2026-08-31

RESTEasy is a Java framework for building RESTful web services. This vulnerability allows unauthenticated attackers to read arbitrary files from the server by sending specially crafted XML requests to endpoints that process XML input. An attacker can extract sensitive files like configuration files or credentials, potentially compromising the entire application and underlying systems.

Technologies: [Red Hat RESTEasy](https://junglewise.ai/threats/technologies/resteasy). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-17615 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17615 being exploited in the wild.

**How severe is CVE-2026-17615?** High severity, with a CVSS score of 7.5, published 31 August 2026.

**Which products and versions are affected?** Red Hat RESTEasy.

**Is there a fix for CVE-2026-17615?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-17615 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-17615?** Check whether you run Red Hat RESTEasy. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider.writeTo() method. The vulnerable component creates a SAXParser without disabling external entity resolution, allowing attackers to send DOCTYPE declarations with external entity references in XML request bodies. When the server processes XML with Source or StreamSource return types, it resolves the external entity and includes file contents in the HTTP response. The attack requires no authentication and can be triggered over the network against any endpoint accepting application/xml content-type.

## Affected products

- Red Hat RESTEasy

## Timeline

- 2026-08-31: disclosed

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)

## Related threats

- [RESTEasy default exception mapper information disclosure](https://junglewise.ai/threats/cve-2026-120971-resteasy-s-default-exception-mapper-returns-an-exception-s)
- [Red Hat RESTEasy denial of service in IIOImageProvider](https://junglewise.ai/threats/cve-2026-89059-red-hat-resteasy-denial-of-service-in-iioimageprovider)
- [Red Hat RESTEasy CORS header injection in CorsFilter](https://junglewise.ai/threats/cve-2026-89058-red-hat-resteasy-cors-header-injection-in-corsfilter)