A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

redhat RHSA-2026:80505: RHSA-2026:80505: resteasy security update (Important)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77297 advisory.

    RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful     Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

    Security Fix(es):

    * resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2026_72424 advisory.

    * resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72424 advisory.

    [3.0.26-20]
    - Fix CVE-2026-17615: SourceProvider remote unauthenticated file read       Resolves: RHEL-251553

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1935:01 advisory.

    * resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of resteasy-base installed on the remote host is prior to 3.0.6-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3936 advisory.

    A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to     perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE     declaration referencing external entities to an endpoint that accepts application/xml and returns Source     or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents     in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without     disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
    (CVE-2026-17615)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72424 advisory.

    * resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72424 advisory.

    RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful     Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

    Security Fix(es):

    * resteasy-core: RESTeasy SourceProvider remote unauthenticated file read (CVE-2026-17615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to     perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE     declaration referencing external entities to an endpoint that accepts application/xml and returns Source     or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents     in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without     disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.
    (CVE-2026-17615)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364156	RHEL 9 : resteasy (RHSA-2026:77297)	Nessus	Red Hat Local Security Checks	Local	high
359525	Rocky Linux 9 [CIQ] Security Update: pki-resteasy-client / pki-resteasy-core / etc (crlsa-2026_72424)	Nessus	Rocky Linux Local Security Checks	Local	high
351130	Oracle Linux 9 : resteasy (ELSA-2026-72424)	Nessus	Oracle Linux Local Security Checks	Local	high
351107	MiracleLinux 9 : resteasy-3.0.26-20.el9_8 (AXSA:2026-1935:01)	Nessus	Miracle Linux Local Security Checks	Local	high
351066	Amazon Linux 2 : resteasy-base (ALAS-2026-3936)	Nessus	Amazon Linux Local Security Checks	Local	high
350962	RockyLinux 9 : resteasy (RLSA-2026:72424)	Nessus	Rocky Linux Local Security Checks	Local	high
350918	RHEL 9 : resteasy (RHSA-2026:72424)	Nessus	Red Hat Local Security Checks	Local	high
341763	Linux Distros Unpatched Vulnerability : CVE-2026-17615	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-17615

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high