CVE-2026-17615: RESTEasy SourceProvider XXE Vulnerability

CVE-2026-17615 Overview

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider component. The flaw allows an unauthenticated remote attacker to read arbitrary files from the server file system. An attacker sends a crafted XML payload containing a DOCTYPE declaration with external entity references to any endpoint that accepts application/xml and returns a Source or StreamSource object. The SourceProvider.writeTo() method constructs a SAXParser without disabling external entity resolution, causing the parser to fetch referenced files and echo their contents in the HTTP response. The vulnerability is tracked under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive files, including configuration data, credentials, and application secrets, from any RESTEasy service exposing an XML endpoint that returns Source types.

Affected Products

RESTEasy (JBoss/Red Hat REST framework) — versions using the vulnerable SourceProvider implementation
Applications and middleware bundling RESTEasy that expose endpoints consuming application/xml and returning Source or StreamSource
Refer to the Red Hat CVE-2026-17615 Advisory for the authoritative list of affected packages

Discovery Timeline

2026-08-31 - CVE-2026-17615 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-17615

Vulnerability Analysis

RESTEasy is a widely deployed JAX-RS implementation used to build RESTful web services on the Java Virtual Machine. The SourceProvider class handles XML request bodies that are deserialized into javax.xml.transform.Source or StreamSource objects. During processing, SourceProvider.writeTo() instantiates a SAXParser from a SAXParserFactory without configuring the parser to reject external entities or disallow inline DOCTYPE declarations.

When the parser encounters a DOCTYPE block referencing external system identifiers, it dereferences those identifiers. Local file:// URIs are read directly from the server file system, and remote URIs can be used to reach internal services. The dereferenced content is injected into the parsed XML tree and can be reflected back in the response, enabling out-of-band or in-band data exfiltration.

The vulnerability is exploitable without authentication and without user interaction against any application that exposes an XML-consuming JAX-RS endpoint whose method signature involves a Source type.

Root Cause

The root cause is missing hardening on the SAX parser. Secure XML processing requires disabling the http://apache.org/xml/features/disallow-doctype-decl feature to false and setting external-general-entities and external-parameter-entities features to false, or applying XMLConstants.FEATURE_SECURE_PROCESSING. SourceProvider.writeTo() performs none of these configuration steps, leaving the underlying parser in its permissive default state.

Attack Vector

An unauthenticated attacker sends an HTTP POST or PUT request with Content-Type: application/xml targeting any RESTEasy endpoint that accepts a Source parameter. The request body includes a DOCTYPE declaration defining an external entity that references a local file such as /etc/passwd or a Java KeyStore path. The parser resolves the entity, and the returned or logged XML contains the sensitive file contents. The vulnerability is described in prose because no verified public proof-of-concept code is available at the time of writing. See the Red Hat Bug Report #2507635 for additional technical context.

Detection Methods for CVE-2026-17615

Indicators of Compromise

Inbound HTTP requests with Content-Type: application/xml bodies containing <!DOCTYPE and <!ENTITY declarations, especially with SYSTEM identifiers referencing file://, http://, or ftp:// URIs.
Application logs showing SAX parser file access events or XML parsing errors referencing external entity resolution failures.
Unexpected outbound network connections originating from the RESTEasy application server toward attacker-controlled hosts, indicating out-of-band XXE exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect XML request bodies for DOCTYPE and ENTITY tokens and block or alert on their presence.
Enable verbose access logging on JAX-RS endpoints and correlate application/xml requests with subsequent file system reads by the Java process.
Use runtime application self-protection (RASP) instrumentation to flag SAXParser and DocumentBuilder instances created without secure processing features.

Monitoring Recommendations

Monitor RESTEasy application processes for reads of sensitive paths such as /etc/passwd, /etc/shadow, ~/.ssh/, and application configuration directories.
Alert on egress connections from application servers to non-approved destinations, which may indicate blind XXE data extraction.
Track HTTP response sizes and content patterns from XML endpoints; large or anomalous responses containing file-like content warrant investigation.

How to Mitigate CVE-2026-17615

Immediate Actions Required

Apply the patched RESTEasy version as identified in the Red Hat CVE-2026-17615 Advisory as soon as it is available for your distribution.
Inventory all applications using RESTEasy and identify endpoints that consume application/xml and bind to Source or StreamSource parameters.
Restrict network exposure of vulnerable endpoints until patches or configuration mitigations are in place.

Patch Information

Red Hat tracks remediation for affected packages under CVE-2026-17615 and Bug Report #2507635. Consult these advisories for fixed package versions and errata specific to your RESTEasy distribution. The upstream fix hardens SourceProvider to disable DOCTYPE declarations and external entity resolution on the internal SAXParser.

Workarounds

Configure a servlet filter or JAX-RS request filter to reject XML request bodies containing <!DOCTYPE declarations before they reach SourceProvider.
Replace Source/StreamSource parameters with JAXB or Jackson XML binding types, which apply secure XML processing by default in current versions.
Deploy a WAF rule blocking XML payloads with external entity references directed at RESTEasy endpoints.

bash

# Configuration example
# Set JVM system properties to enforce secure XML processing across parsers
java \
  -Djavax.xml.accessExternalDTD="" \
  -Djavax.xml.accessExternalSchema="" \
  -Djdk.xml.entityExpansionLimit=0 \
  -jar your-resteasy-app.jar