CVE-2026-17615

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in RESTEasy's SourceProvider component. The root cause is that SourceProvider.writeTo() creates a SAXParser without disabling external entity resolution. An unauthenticated attacker can exploit this by sending a specially crafted XML bo...