The tests in the org.jboss.resteasy.test.xxe package fail with java version "9.0.4":
They fail to read external DTD file. Which is controled by accessExternalDTD . And I am able to reproduce it locally.
If we want to keep ability to read external DTD files it should be configurable IMHO.