CVE-2026-17615: Improper Restriction of XML External Entity Reference in Red Hat Red Hat Build of Apache Camel 3.33.3.SP1

The vulnerability exists in RESTEasy's SourceProvider.writeTo() method, which creates a SAXParser without disabling external entity resolution. An attacker can exploit this by sending a specially crafted XML body containing a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource. This causes the server to resolve the external entity and include sensitive file contents in the HTTP response, resulting in an unauthenticated remote file read. The issue affects the Red Hat build of Keycloak 26.6. Red Hat has acknowledged the vulnerability and provided a security advisory with a fix.

An unauthenticated attacker can remotely read arbitrary files on the vulnerable server by exploiting the XXE vulnerability. This can lead to disclosure of sensitive information, impacting confidentiality. There is no impact on integrity or availability reported. The vulnerability has a high severity rating (CVSS 7.5).

Red Hat has issued an official fix for this vulnerability. Users should apply the update provided in Red Hat Security Advisory RHSA-2026:63302 to remediate the issue. Before applying the update, back up existing installations including applications, configuration files, and databases. Patch status is confirmed by the vendor advisory.