EUVD-2026-68654
GHSA-h82j-45qh-f65r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated endpoint, no complexity barriers; impact is read-only file exfiltration with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
AnalysisAI
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary server-side files by exploiting an XML External Entity (XXE) flaw. The vulnerability exists because SourceProvider.writeTo() instantiates a SAXParser without disabling external entity resolution, so any endpoint that accepts application/xml and returns a Source or StreamSource type will parse attacker-controlled DOCTYPE declarations and leak file contents in the HTTP response. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a JAX-RS endpoint in a RESTEasy-backed application that simultaneously: (1) accepts the 'application/xml' media type in its @Consumes annotation or equivalent configuration, and (2) returns a javax.xml.transform.Source or javax.xml.transform.stream.StreamSource object as its response type, causing RESTEasy to route serialisation through the vulnerable SourceProvider. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) faithfully reflects the threat model: the attack is fully remote, requires no credentials, and incurs no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade to the RESTEasy version that ships the hardened SourceProvider, as released by Red Hat; consult the advisory at https://access.redhat.com/security/cve/CVE-2026-17615 and the Bugzilla ticket at https://bugzilla.redhat.com/show_bug.cgi?id=2507635 for the exact patched component versions - specific fix version numbers are not independently confirmed in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all RESTEasy deployments accepting XML requests by reviewing application configurations, particularly SourceProvider endpoints and services returning Source or StreamSource types. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attacke
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
WildFly Elytron's password hashing and verification subsystem silently normalizes Unicode input via NFKC before hashing,
Share
External POC / Exploit Code
Leaving vuln.today