Description
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | — | — |
| Red Hat | Red Hat build of Debezium 3 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | resteasy3.0 | No fix yet | — |
| Debian 13 | resteasy3.0 | No fix yet | — |
| Debian 12 | resteasy3.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | resteasy +1 | No fix yet | — |
| Ubuntu 26.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu 24.04 LTS | resteasy3.0 | No fix yet | — |
| Ubuntu 22.04 LTS | resteasy3.0 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | resteasy | No fix yet | — |
| Ubuntu Pro 22.04 LTS | resteasy | No fix yet | — |
| Ubuntu Pro 20.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | resteasy3.0 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | resteasy | No fix yet | — |
References
- https://access.redhat.com/security/cve/CVE-2026-120971 vdb-entry
- RHBZ#2565584 issue-tracking