A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a...
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2026-120971 resteasy3.0 No fixed version in this record
- Ubuntu UBUNTU-CVE-2026-120971 resteasy3.0, resteasy No fixed version in this record
Original description The description as published by the source.
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web secalert@redhat.com
- web secalert@redhat.com
- web nvd.nist.gov
- web github.com