CVE-2011-5245: The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attacker...

Security readout for executives and security teams

CVE-2011-5245 is an XXE flaw in RESTEasy before 2.3.2. A remote attacker could abuse XML input handled through JAXB to read files from the server. That can expose secrets, configuration, or application data if affected endpoints accept untrusted XML. Exposure is most likely in Java services using RESTEasy before 2.3.2 with endpoints that deserialize attacker-controlled JAXB/XML request bodies. The bundle does not identify specific downstream products beyond RESTEasy and referenced Red Hat advisories. Prioritize remediation for externally reachable Java services accepting XML. The issue can expose local files and secrets, but the bundle lacks severity scoring and active exploitation evidence, so urgency depends on exposure and data sensitivity. Mitigation focus: Upgrade RESTEasy to 2.3.2 or later where applicable.; Apply relevant vendor-fixed Red Hat packages if using affected distributions.; Review vendor advisories for product-specific package names and backports..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.