Read the docs
TI-2026-14443 Aliases CVE-2026-17615GHSA-h82j-45qh-f65r

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Priority MEDIUM 40CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 10 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-611 and the CVSS impact.

Summary

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0085 58th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 10 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat Build of Apache Camel 3.33.3.SP1—6.2.16.Final-redhat-00003Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6.7-3Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-20Patch availableCNA
Red HatRed Hat build of Keycloak 26.6—26.6-20Patch availableCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat build of Keycloak 26.6.7——Not affectedCNA
Red HatRed Hat build of Quarkus 3.27.5.SP1—6.2.12.Final-redhat-00003Patch availableCNA
Red HatRed Hat build of Quarkus 3.33.3.SP1—6.2.16.Final-redhat-00003Patch availableCNA
Red HatRed Hat Enterprise Linux 9—3.0.26-20.el9_8Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—3.0.26-16.el9_2Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—3.0.26-20.el9_4Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—3.0.26-20.el9_6Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 8.1——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform 8.1——Not affectedCNA
Red HatRed Hat build of Apache Camel 4 for Quarkus 3——No fix listedCNA
Red HatRed Hat build of Apicurio Registry 3——No fix listedCNA
Red HatRed Hat build of Debezium 3——No fix listedCNA
Red HatRed Hat Enterprise Linux 8——No fix listedCNA
Red HatRed Hat Enterprise Linux 8——Not affectedCNA
Red HatRed Hat Fuse 7——Not affectedCNA
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack——No fix listedCNA
Red HatRed Hat Satellite 6——Not affectedCNA
  • Red Hat Build of Apache Camel 3.33.3.SP1 VendorRed Hat Affected — Fixed in 6.2.16.Final-redhat-00003 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6.7-3 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-20 Patch available CNA
  • Red Hat build of Keycloak 26.6 VendorRed Hat Affected — Fixed in 26.6-20 Patch available CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Keycloak 26.6.7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Quarkus 3.27.5.SP1 VendorRed Hat Affected — Fixed in 6.2.12.Final-redhat-00003 Patch available CNA
  • Red Hat build of Quarkus 3.33.3.SP1 VendorRed Hat Affected — Fixed in 6.2.16.Final-redhat-00003 Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 3.0.26-20.el9_8 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 3.0.26-16.el9_2 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 3.0.26-20.el9_4 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 3.0.26-20.el9_6 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 8.1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform 8.1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat build of Apicurio Registry 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat build of Debezium 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Satellite 6 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 17

CPEVersionsRoleVendor
cpe:/a:redhat:apache_camel_quarkus:3.333.33—Red Hat
cpe:/a:redhat:build_keycloak:26.6::el926.6—Red Hat
cpe:/a:redhat:quarkus:3.273.27—Red Hat
cpe:/a:redhat:quarkus:3.333.33—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_e4s:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform:8.18.1—Red Hat
cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.06.0—Red Hat
  • cpe:/a:redhat:apache_camel_quarkus:3.33 Versions 3.33 — ·Red Hat
  • cpe:/a:redhat:build_keycloak:26.6::el9 Versions 26.6 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.27 Versions 3.27 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.33 Versions 3.33 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat
  • cpe:/a:redhat:jboss_enterprise_application_platform:8.1 Versions 8.1 — ·Red Hat
  • cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0 Versions 6.0 — ·Red Hat
Show 7 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:camel_quarkus:33—Red Hat
cpe:/a:redhat:apicurio_registry:33—Red Hat
cpe:/a:redhat:debezium:33—Red Hat
cpe:/a:redhat:enterprise_linux:88—Red Hat
cpe:/a:redhat:jboss_fuse:77—Red Hat
cpe:/a:redhat:jbosseapxp——Red Hat
cpe:/a:redhat:satellite:66—Red Hat
  • cpe:/a:redhat:camel_quarkus:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:apicurio_registry:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:debezium:3 Versions 3 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
  • cpe:/a:redhat:jboss_fuse:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
  • cpe:/a:redhat:satellite:6 Versions 6 — ·Red Hat

Remediation

Red Hat 11 advisories

  • RHSA-2026:95887 Released 2026-11-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:95221 Released 2026-11-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 XP 6.0.7.GA release
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:90894 Released 2026-10-27 · Red Hat rating Important
    resteasy security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pki-resteasy-client-3.0.26-16.el9_2, pki-resteasy-core-3.0.26-16.el9_2, pki-resteasy-jackson2-provider-3.0.26-16.el9_2 +1
Show 8 more Red Hat advisories
  • RHSA-2026:80505 Released 2026-10-12 · Red Hat rating Important
    resteasy security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pki-resteasy-client-3.0.26-20.el9_4, pki-resteasy-core-3.0.26-20.el9_4, pki-resteasy-jackson2-provider-3.0.26-20.el9_4 +2
  • RHSA-2026:77297 Released 2026-10-08 · Red Hat rating Important
    resteasy security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pki-resteasy-client-3.0.26-20.el9_6, pki-resteasy-core-3.0.26-20.el9_6, pki-resteasy-jackson2-provider-3.0.26-20.el9_6 +2
  • RHSA-2026:72424 Released 2026-09-28 · Red Hat rating Important
    resteasy security update
    • Red Hat Enterprise Linux AppStream (v. 9) pki-resteasy-client-3.0.26-20.el9_8, pki-resteasy-core-3.0.26-20.el9_8, pki-resteasy-jackson2-provider-3.0.26-20.el9_8 +2
  • RHSA-2026:68277 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.7 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:68278 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.7 Security Update
    • Red Hat build of Keycloak 26.6.7
  • RHSA-2026:63302 Released 2026-09-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.SP1)
    • Red Hat Build of Apache Camel 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-qute-3.33.3.redhat-00005.jar +5
  • RHSA-2026:62555 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.3.SP1 release and security update
    • Red Hat build of Quarkus 3.33.3.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-oidc-3.33.3.redhat-00005.jar +6
  • RHSA-2026:62515 Released 2026-09-03 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.5.SP1 release and security update
    • Red Hat build of Quarkus 3.27.5.SP1 io.netty.netty-codec-http-4.1.137.Final-redhat-00001.jar, io.netty.netty-handler-4.1.137.Final-redhat-00001.jar, io.quarkus.quarkus-apache-httpclient-3.27.5.redhat-00004.jar +7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform Expansion Pack and 3 more products — RHSA-2026:62515

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-10988 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability…Priority MEDIUM 42
    • TI-2026-53641 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsPriority MEDIUM 40
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform Expansion Pack and 3 more products — RHSA-2026:62555

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-10988 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability…Priority MEDIUM 42
    • TI-2026-53641 Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literalsPriority MEDIUM 40
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Build of Apache Camel 3.33.3.SP1, Red Hat JBoss Enterprise Application Platform Expansion Pack and 3 more products — RHSA-2026:63302

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-10988 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability…Priority MEDIUM 42
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.3.SP1Fixed RHSA-2026:63302
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:72424
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:90894
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:80505
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:77297
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95221
Red Hat build of Keycloak 26.6Fixed RHSA-2026:68277
Red Hat build of Keycloak 26.6.7Fixed RHSA-2026:68278
Red Hat build of Quarkus 3.27.5.SP1Fixed RHSA-2026:62515
Red Hat build of Quarkus 3.33.3.SP1Fixed RHSA-2026:62555
Not affected: 6 products
  • Red Hat Build of Apache Camel 3.33.3.SP1
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat Satellite 6
  • Red Hat build of Quarkus 3.27.5.SP1
  • Red Hat build of Quarkus 3.33.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-17615
  2. 2026-10-03 Alias added: GHSA-h82j-45qh-f65r
  3. 2026-10-08 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
  4. 2026-10-08 Fix available: resteasy@0:3.0.26-20.el9_6 · CNA
  5. 2026-10-08 1 new reference · CNA
  6. 2026-10-09 Fix available: RHSA-2026:77297 · Red Hat
  7. 2026-10-09 Fix available: RHSA-2026:62555 · Red Hat
  8. 2026-10-09 Fix available: RHSA-2026:63302 · Red Hat
  9. 2026-10-09 Fix available: RHSA-2026:62515 · Red Hat
  10. 2026-10-10 Fix available: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1, Red Hat build of Quarkus 3.27.5.SP1, Red Hat build of Quarkus 3.33.3.SP1 · Red Hat
  11. 2026-10-10 Affected versions changed · CNA
  12. 2026-10-11 Priority changed: LOW → MEDIUM
  13. 2026-10-12 Fix available: resteasy@0:3.0.26-20.el9_4 · CNA
  14. 2026-10-12 1 new reference · CNA
  15. 2026-10-12 Fix available: RHSA-2026:80505 · Red Hat
  16. 2026-10-12 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat
  17. 2026-10-12 Fix available: org.jboss.resteasy/[email protected] · CNA
  18. 2026-10-12 Fix available: Red Hat Build of Apache Camel 3.33.3.SP1 · Red Hat
  19. 2026-10-20 Fix available: org.jboss.resteasy/[email protected] · CNA
  20. 2026-10-20 Affected versions changed · Red Hat
  21. 2026-10-25 EPSS moved to the 50th–90th percentile
  22. 2026-10-28 Fix available: resteasy@0:3.0.26-16.el9_2 · CNA
  23. 2026-10-28 1 new reference · CNA
  24. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat
  25. 2026-10-29 Fix available: RHSA-2026:90894 · Red Hat
  26. 2026-11-04 Affected versions changed · CNA
  27. 2026-11-04 1 new reference · CNA
  28. 2026-11-04 Fix available: RHSA-2026:95221 · Red Hat
  29. 2026-11-04 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
  30. 2026-11-06 Affected versions changed · CNA
  31. 2026-11-06 1 new reference · CNA
  32. 2026-11-06 Fix available: RHSA-2026:95887 · Red Hat
  33. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 11

Other 2

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences