From 0ca341e2c25153e9312e6a54f313028926002e25 Mon Sep 17 00:00:00 2001 From: "James R. Perkins" Date: Tue, 1 Sep 2026 11:04:57 -0700 Subject: [PATCH] Add release notes for 7.0.4.Final and 6.2.18.Final. Signed-off-by: James R. Perkins --- content/posts/2026-09-01-releases.adoc | 60 ++++++++++++++++++++++++++ data/releases.yaml | 34 +++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 content/posts/2026-09-01-releases.adoc diff --git a/content/posts/2026-09-01-releases.adoc b/content/posts/2026-09-01-releases.adoc new file mode 100644 index 0000000..e2891c3 --- /dev/null +++ b/content/posts/2026-09-01-releases.adoc @@ -0,0 +1,60 @@ +--- +layout: post +title: "RESTEasy 6.2.18.Final and 7.0.4.Final Releases" +date: 2026-09-01 +author: James R. Perkins +--- + +Today we would like to announce the release of RESTEasy link:/downloads#6218final[6.2.18.Final] and RESTEasy +link:/downloads#704final[7.0.4.Final]. These are small releases, but we would encourage all users to upgrade as both +address a security vulnerability. + +Both releases fix https://redhat.atlassian.net/browse/RESTEASY-3785[RESTEASY-3785], an XML External Entity (XXE) +vulnerability in `SourceProvider` tracked as +https://github.com/resteasy/resteasy/security/advisories/GHSA-339g-695r-wx4w[CVE-2026-17615] (CVSS 7.5, High). The +provider parsed XML without disabling external entity resolution, which could allow an unauthenticated remote attacker +to read arbitrary files on the server and to perform blind XXE and SSRF attacks against internal resources. Anyone +running an affected version (6.2.17.Final or 7.0.3.Final and earlier) should upgrade to 6.2.18.Final or 7.0.4.Final. +While it is ranked High, the vulnerability only affects endpoints that accept a `javax.xml.transform.Source` entity parameter. + +== 7.0.4.Final + +RESTEasy 7.0.4.Final is a https://jakarta.ee/specifications/restful-ws/4.0/[Jakarta REST 4.0] implementation. This +release includes a security fix, a bug fix, and component upgrades. + +=== Bug + +* https://redhat.atlassian.net/browse/RESTEASY-3785[RESTEASY-3785] CVE-2026-17615 resteasy-core: RESTeasy SourceProvider remote unauthenticated file read +* https://redhat.atlassian.net/browse/RESTEASY-3751[RESTEASY-3751] EntityOutputStream should use a concurrent lock instead of synchronizing on a object + +=== Component Upgrade + +* https://redhat.atlassian.net/browse/RESTEASY-3787[RESTEASY-3787] Bump com.fasterxml.jackson:jackson-bom from 2.21.5 to 2.21.6 in the fasterxml-dependencies group across 1 directory +* https://redhat.atlassian.net/browse/RESTEASY-3792[RESTEASY-3792] Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.2 to 3.0.3 in the jakarta-json-dependencies group + +=== Task + +* https://redhat.atlassian.net/browse/RESTEASY-3791[RESTEASY-3791] Add additional test to the resteasy-embedded-server-tests + +Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v7.0.4.Final. + +== 6.2.18.Final + +RESTEasy 6.2.18.Final is a https://jakarta.ee/specifications/restful-ws/3.1/[Jakarta REST 3.1] implementation. This +release includes a security fix and component upgrades. + +=== Bug + +* https://redhat.atlassian.net/browse/RESTEASY-3785[RESTEASY-3785] CVE-2026-17615 resteasy-core: RESTeasy SourceProvider remote unauthenticated file read + +=== Component Upgrade + +* https://redhat.atlassian.net/browse/RESTEASY-3786[RESTEASY-3786] Bump version.io.netty.netty4 from 4.1.136.Final to 4.1.137.Final +* https://redhat.atlassian.net/browse/RESTEASY-3788[RESTEASY-3788] Bump com.fasterxml.jackson:jackson-bom from 2.18.9 to 2.18.10 in the fasterxml-dependencies group across 1 directory +* https://redhat.atlassian.net/browse/RESTEASY-3792[RESTEASY-3792] Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.2 to 3.0.3 in the jakarta-json-dependencies group + +Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v6.2.18.Final. + +== Finally + +As always, https://github.com/resteasy/resteasy/discussions/[feedback] is welcome. Stay safe, and, depending on where you are, stay warm or be cool. diff --git a/data/releases.yaml b/data/releases.yaml index f13d991..dca234f 100644 --- a/data/releases.yaml +++ b/data/releases.yaml @@ -1,6 +1,23 @@ - group: 7.0.x supported: true detail: + - version: 7.0.4.Final + date: 2026-09-01 + license: ASL v2 + source: https://github.com/resteasy/resteasy/releases/download/v7.0.4.Final/resteasy-7.0.4.Final-src.zip + size: 33.3 MB + release_notes: https://github.com/resteasy/resteasy/releases/tag/v7.0.4.Final + download_link: https://github.com/resteasy/resteasy/releases/download/v7.0.4.Final/resteasy-7.0.4.Final-all.zip + download_text: resteasy-7.0.4.Final-all.zip + jakarta_rest_spec: + version: 4.0 + link: https://jakarta.ee/specifications/restful-ws/4.0/jakarta-restful-ws-spec-4.0.html + java_doc: https://jakarta.ee/specifications/restful-ws/4.0/apidocs + documentation: + examples: https://github.com/resteasy/resteasy-examples/ + link: https://docs.resteasy.dev/7.0/userguide/ + pdf: https://docs.resteasy.dev/7.0/userguide/resteasy-reference-guide.pdf + java_doc: https://docs.resteasy.dev/7.0/javadocs/ - version: 7.0.3.Final date: 2026-08-03 license: ASL v2 @@ -72,6 +89,23 @@ - group: 6.2.x supported: true detail: + - version: 6.2.18.Final + date: 2026-09-01 + license: ASL v2 + source: https://github.com/resteasy/resteasy/releases/download/v6.2.18.Final/resteasy-6.2.18.Final-src.zip + size: 38.5 MB + release_notes: https://github.com/resteasy/resteasy/releases/tag/v6.2.18.Final + download_link: https://github.com/resteasy/resteasy/releases/download/v6.2.18.Final/resteasy-6.2.18.Final-all.zip + download_text: resteasy-6.2.18.Final-all.zip + jakarta_rest_spec: + version: 3.1 + link: https://jakarta.ee/specifications/restful-ws/3.1/jakarta-restful-ws-spec-3.1.html + java_doc: https://jakarta.ee/specifications/restful-ws/3.1/apidocs + documentation: + examples: https://github.com/resteasy/resteasy-examples/ + link: https://docs.resteasy.dev/6.2/userguide/ + pdf: https://docs.resteasy.dev/6.2/userguide/resteasy-reference-guide.pdf + java_doc: https://docs.resteasy.dev/6.2/javadocs/ - version: 6.2.17.Final date: 2026-08-03 license: ASL v2