Skip to content
OpenAdvisories
High USN-7630-1 11 CVEs

resteasy, resteasy3.0 vulnerabilities

Published Jul 10, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that RESTEasy made insufficient use of random values in
asynchronous jobs. An attacker could possibly use this issue to steal
user data. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6345)

It was discovered that RESTEasy enabled a vulnerable GZIP decompression
module by default. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-6346)

It was discovered that RESTEasy improperly made use of unsanitized data
while handling certain errors. An attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6347)

It was discovered that RESTEasy enabled a vulnerable JSON manipulation
module by default. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6348)

It was discovered that RESTEasy enabled a vulnerable deserialization
module by default. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7050)

Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding
when certain errors occur. An attacker could possibly use this issue to
modify the app's behavior for other users throughout the network.
This issue did not affect resteasy3.0 in Ubuntu 24.04 LTS, Ubuntu 24.10,
and Ubuntu 25.04. (CVE-2020-10688)

Mirko Selber discovered that RESTEasy improperly validated user input
during HTTP response construction. An attacker could possibly use this
issue to to cause a denial of service or execute arbitrary code.
This issue did not affect resteasy3.0 in Ubuntu 22.04 LTS,
Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2020-1695)

It was discovered that RESTEasy improperly handled receiving the
WebApplicationException during a client call. An attacker could possibly
use this issue to obtain potentially sensitive server information.
(CVE-2020-25633)

It was discovered that RESTEasy improperly populated exception responses
with endpoint class and method names. An attacker could possibly use this
issue to obtain potentially sensitive server information. (CVE-2021-20289)

It was discovered that RESTEasy used improper permissions when creating
temporary files. An attacker could possibly use this issue to get access to
sensitive data. (CVE-2023-0482)

It was discovered that RESTEasy improperly handled certain HTTP requests
containing ASCII control characters. An attacker could possibly use this
issue to cause a denial of service. (CVE-2024-9622)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS resteasy3.0 3.0.26-3ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS resteasy3.0 3.0.26-6ubuntu0.24.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS resteasy 3.0.6-3ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS resteasy3.0 3.0.26-1~18.04.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS resteasy3.0 3.0.26-1ubuntu0.1~esm1

Vulnerabilities 11

References

  • report
    https://ubuntu.com/security/CVE-2016-6345
  • report
    https://ubuntu.com/security/CVE-2016-6346
  • report
    https://ubuntu.com/security/CVE-2016-6347
  • report
    https://ubuntu.com/security/CVE-2016-6348
  • report
    https://ubuntu.com/security/CVE-2016-7050
  • report
    https://ubuntu.com/security/CVE-2020-1695
  • report
    https://ubuntu.com/security/CVE-2020-10688
  • report
    https://ubuntu.com/security/CVE-2020-25633
  • report
    https://ubuntu.com/security/CVE-2021-20289
  • report
    https://ubuntu.com/security/CVE-2023-0482
  • report
    https://ubuntu.com/security/CVE-2024-9622