Hi,

The following vulnerability was published for resteasy.

Note it is not fully clear with the light details, but this should
relate to the upstream commit[1], can you please check?

CVE-2026-17615[0]:
| A flaw was found in RESTEasy's SourceProvider. This vulnerability
| allows an unauthenticated attacker to perform an unauthenticated
| remote file read. By sending a specially crafted XML body with a
| DOCTYPE declaration referencing external entities to an endpoint
| that accepts application/xml and returns Source or StreamSource, the
| server can be tricked into resolving the entity and including
| sensitive file contents in the HTTP response. This is due to the
| SourceProvider.writeTo() method creating a SAXParser without
| disabling external entity resolution, leading to an XML External
| Entity (XXE) vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-17615
https://www.cve.org/CVERecord?id=CVE-2026-17615
[1] https://github.com/resteasy/resteasy/commit/dc48c6f46f39af987652e04254f5ec8ac996bc26

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore