CVE-2026-120971 PUBLISHED

Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

Assigner: redhat
Reserved: 03.11.2026 Published: 03.11.2026 Updated: 03.11.2026

A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor Red Hat
Product Red Hat build of Apache Camel 4 for Quarkus 3
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apicurio Registry 3
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Debezium 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Quarkus
Versions Default: affected
Vendor Red Hat
Product Red Hat Fuse 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 8
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform Expansion Pack
Versions Default: affected
Vendor Red Hat
Product Red Hat Satellite 6
Versions Default: affected

Credits

  • Red Hat would like to thank Yu Bao (PayPal Cyber Security Team) for reporting this issue.

References

Problem Types

  • Generation of Error Message Containing Sensitive Information CWE