The vulnerability stems from RESTEasy's SourceProvider, which creates a SAXParser without disabling external entity resolution during the writeTo() operation. This oversight allows an attacker to submit a crafted XML payload containing a DOCTYPE declaration that references an external entity. When the server processes such a request to an endpoint that accepts application/xml and returns a Source or StreamSource, it resolves the entity and includes the contents of the referenced file in the HTTP response, effectively leaking arbitrary files from the host. The flaw permits remote disclosure of sensitive data and is classified as XML External Entity (XXE) CVE-2026-17615.

Affected systems include Red Hat Build of Keycloak, Red Hat Enterprise Linux 8 and 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Satellite 6, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Apicurio Registry 3, Red Hat Debezium 3, and Red Hat build of Quarkus. Specific version information is not listed, so any deployment using RESTEasy services should assess whether the vulnerable release is in use.

The CVSS score of 7.5 indicates a high-severity impact, although the EPSS score is not available, limiting view of likelihood. The vulnerability is not listed in CISA’s KEV catalog. Attack requires network access to expose a RESTEasy endpoint that returns Source or StreamSource and is unauthenticated; attackers send a malicious XML body to trigger the XXE.