Lucene search
+L

CVE-2026-17615

🗓️ 31 Aug 2026 16:15:01Reported by redhatType 
cve
 cve
🔗 web.nvd.nist.gov👁 74 Views

Unauthenticated XXE in RESTEasy SourceProvider enables remote file read via crafted XML.

Related
Detection
Affected
Refs
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty, bundled with IBM WebSphere Hybrid Edition, is affected by multiple vulnerabilities
3 Nov 202618:16
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty, bundled with IBM Cloud Pak for Applications, is affected by multiple vulnerabilities
3 Nov 202618:31
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty, bundled with IBM Enterprise Application Runtimes, is affected by multiple vulnerabilities
3 Nov 202618:37
–ibm
ibm
IBM Security Bulletins
Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.
2 Nov 202609:32
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
7 Sep 202607:04
–ibm
ibm
IBM Security Bulletins
Security Bulletin: IBM WebSphere Application Server Liberty is affected by an improper restriction of XML external entity vulnerability due to RESTEasy (CVE-2026-17615)
13 Oct 202613:39
–ibm
ibm
IBM Security Bulletins
Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.
2 Nov 202609:55
–ibm
nessus
Tenable Nessus
Amazon Linux 2 : resteasy-base (ALAS-2026-3936)
29 Sep 202600:00
–nessus
nessus
Tenable Nessus
Rocky Linux 9 [CIQ] Security Update: pki-resteasy-client / pki-resteasy-core / etc (crlsa-2026_72424)
1 Oct 202600:00
–nessus
nessus
Tenable Nessus
MiracleLinux 9 : resteasy-3.0.26-20.el9_8 (AXSA:2026-1935:01)
29 Sep 202600:00
–nessus
Rows per page
Vulners
Node
OR
redhatquarkusMatch3.27
redhatquarkusMatch3.33
redhatenterprise_linuxMatch9appstream
redhatrhel_e4sMatch9.2appstream
redhatrhel_e4sMatch9.4appstream
redhatrhel_eusMatch9.6appstream
[
  {
    "vendor": "Red Hat",
    "product": "Red Hat Build of Apache Camel 3.33.3.SP1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "org.jboss.resteasy/resteasy-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "6.2.16.Final-redhat-00003",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:apache_camel_quarkus:3.33"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhbk/keycloak-operator-bundle",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "26.6.7-3",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhbk/keycloak-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "26.6-20",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhbk/keycloak-rhel9-operator",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "26.6-20",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6.7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "keycloak/rhbk-rhel9-operator",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6.7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "resteasy-core",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6.7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "rhbk/keycloak-rhel9-operator",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6.7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "rhbk-keycloak-rhel9-operator/rhbk-keycloak-rhel9-operator",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Keycloak 26.6.7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.27.5.SP1",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "org.jboss.resteasy/resteasy-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "6.2.12.Final-redhat-00003",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:quarkus:3.27"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.33.3.SP1",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "org.jboss.resteasy/resteasy-core",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "6.2.16.Final-redhat-00003",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:quarkus:3.33"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.0.26-20.el9_8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.0.26-16.el9_2",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:rhel_e4s:9.2::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.0.26-20.el9_4",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:rhel_e4s:9.4::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:3.0.26-20.el9_6",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:rhel_eus:9.6::appstream"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "resteasy-core",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apicurio Registry 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:apicurio_registry:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Debezium 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:debezium:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "pki-core:10.6/resteasy",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "pki-deps:10.6/resteasy",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "candlepin",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:satellite:6"
    ]
  }
]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

04 Nov 2026 15:17Current
7High risk
Vulners AI Score7
CVSS 3.17.5
EPSS0.00818
SSVC
74