CVE-2026-17615: Improper Restriction of XML External Entity Reference in Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1

CVE-2026-17615 is an XML External Entity (XXE) vulnerability in the RESTeasy SourceProvider component of Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1. The vulnerability allows remote unauthenticated attackers to read files on the system due to improper restriction of XML external entity references. This issue is part of a broader set of security fixes released by Red Hat in advisory RHSA-2026:63302, which addresses multiple vulnerabilities including denial of service, server impersonation, and credential disclosure in related components. The CVSS v3.1 base score is 7.5 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

The vulnerability allows remote unauthenticated attackers to read arbitrary files on the affected system via crafted XML input, potentially exposing sensitive information. The confidentiality impact is high, but there is no impact on integrity or availability. This can lead to information disclosure without requiring authentication or user interaction.

An official security update is available from Red Hat as detailed in advisory RHSA-2026:63302 (https://access.redhat.com/errata/RHSA-2026:63302). Users should apply the update to Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.3.SP1 to remediate this vulnerability. Before applying the update, back up existing installations and configurations. No additional mitigations are specified by the vendor advisory.