RESTEasy CVE-2026-17615

Exploitation requires a JAX-RS endpoint in a RESTEasy-backed application that simultaneously: (1) accepts the 'application/xml' media type in its @Consumes annotation or equivalent configuration, and (2) returns a javax.xml.transform.Source or javax.xml.transform.stream.StreamSource object as its response type, causing RESTEasy to route serialisation through the vulnerable SourceProvider. This is not a default-enabled blanket condition - it applies only to specific endpoint designs common in XML integration services, SOAP-over-REST adapters, and XML transformation pipelines. Exploitation is limited by: the endpoint must be network-reachable; the server process must have filesystem read access to the targeted file path; and egress filtering can constrain remote entity references (though not file:// URIs). Authentication is not required per the CVSS PR:N vector. There is no requirement for a specific OS or JVM version beyond using a vulnerable RESTEasy build.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) faithfully reflects the threat model: the attack is fully remote, requires no credentials, and incurs no user interaction. The sole impact dimension is confidentiality, consistent with a server-side file read. Despite the high CVSS score, real-world risk is conditional on the presence of JAX-RS endpoints that both accept 'application/xml' and return Source or StreamSource types - a non-default but not rare pattern in enterprise integration services. Environments running RESTEasy-backed APIs behind an API gateway that strips or rejects DOCTYPE declarations are partially mitigated. No CISA KEV listing is present and no POC is referenced in the provided intelligence, reducing immediate mass-exploitation probability; however, XXE is a well-understood class of vulnerability with freely available generic tooling (Burp Suite, XXEInjector), so weaponisation barrier is low once an analyst identifies a qualifying endpoint. EPSS data was not supplied, so probability cannot be quantified numerically. The breadth of affected Red Hat products (Keycloak, Quarkus, Camel, Debezium, EAP, Satellite) significantly expands the attack surface in typical Red Hat enterprise deployments.

An attacker identifies a Red Hat JBoss EAP or Quarkus-based REST endpoint that consumes application/xml and produces a Source or StreamSource response - common in integration middleware and SOAP/REST bridge services. They craft an HTTP POST body containing a DOCTYPE declaration that declares an external entity pointing to a sensitive file such as /etc/passwd or application credential files, then trigger the entity by referencing it in the XML body. The unhardened SAXParser resolves the entity, and the file's contents are embedded in the XML tree and returned in the HTTP 200 response, requiring no authentication and leaving minimal distinguishable application-layer artefacts beyond the XML content-type request.