redhat camel-quarkus CVE-2026-17615 vulnerability in Red Hat Products
Published on August 31, 2026

Resteasy-core: resteasy sourceprovider remote unauthenticated file read
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

NVD

Vulnerability Analysis

CVE-2026-17615 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 35 days later.

Weakness Type

What is a XXE Vulnerability?

The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CVE-2026-17615 has been classified to as a XXE vulnerability or weakness.


Products Associated with CVE-2026-17615

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Camel Quarkus
 
Red Hat Apicurio Registry
 
Red Hat Debezium
 
Red Hat Build Keycloak
 
Red Hat Quarkus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Satellite
 

Affected Versions

Red Hat build of Apache Camel 4 for Quarkus 3: Red Hat build of Apicurio Registry 3: Red Hat build of Debezium 3: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat build of Quarkus: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Satellite 6: