RESTEasy 6.2.18.Final and 7.0.4.Final Releases

By James R. Perkins | September 01, 2026

Today we would like to announce the release of RESTEasy 6.2.18.Final and RESTEasy 7.0.4.Final. These are small releases, but we would encourage all users to upgrade as both address a security vulnerability.

Both releases fix RESTEASY-3785, an XML External Entity (XXE) vulnerability in SourceProvider tracked as CVE-2026-17615 (CVSS 7.5, High). The provider parsed XML without disabling external entity resolution, which could allow an unauthenticated remote attacker to read arbitrary files on the server and to perform blind XXE and SSRF attacks against internal resources. Anyone running an affected version (6.2.17.Final or 7.0.3.Final and earlier) should upgrade to 6.2.18.Final or 7.0.4.Final. While it is ranked High, the vulnerability only affects endpoints that accept a javax.xml.transform.Source entity parameter.

7.0.4.Final

RESTEasy 7.0.4.Final is a Jakarta REST 4.0 implementation. This release includes a security fix, a bug fix, and component upgrades.

Bug

  • RESTEASY-3785 CVE-2026-17615 resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

  • RESTEASY-3751 EntityOutputStream should use a concurrent lock instead of synchronizing on a object

Component Upgrade

  • RESTEASY-3787 Bump com.fasterxml.jackson:jackson-bom from 2.21.5 to 2.21.6 in the fasterxml-dependencies group across 1 directory

  • RESTEASY-3792 Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.2 to 3.0.3 in the jakarta-json-dependencies group

Task

  • RESTEASY-3791 Add additional test to the resteasy-embedded-server-tests

Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v7.0.4.Final.

6.2.18.Final

RESTEasy 6.2.18.Final is a Jakarta REST 3.1 implementation. This release includes a security fix and component upgrades.

Bug

  • RESTEASY-3785 CVE-2026-17615 resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

Component Upgrade

  • RESTEASY-3786 Bump version.io.netty.netty4 from 4.1.136.Final to 4.1.137.Final

  • RESTEASY-3788 Bump com.fasterxml.jackson:jackson-bom from 2.18.9 to 2.18.10 in the fasterxml-dependencies group across 1 directory

  • RESTEASY-3792 Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.2 to 3.0.3 in the jakarta-json-dependencies group

Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v6.2.18.Final.

Finally

As always, feedback is welcome. Stay safe, and, depending on where you are, stay warm or be cool.

Apache License 2.0 Security
Copyright © RESTEasy. All rights reserved. For details on our trademarks, please visit our Trademark Policy and Trademark List. Trademarks of third parties are owned by their respective holders and their mention here does not suggest any endorsement or association.