Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2026-17615

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Apache Camel Quarkus Apicurio Registry Build Keycloak and 19 more
CVE-2016-6348

RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack

JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.

CVSS 3.0 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Resteasy
CVE-2016-6347

RESTEasy: Use of the default exception handler in RESTEasy can lead to reflected XSS attack

Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0 · 6.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Resteasy
CVE-2014-7839

RESTeasy: External entities expanded by DocumentProvider

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2014-3490

RESTEasy: XXE via parameter entities

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Bpms Jboss Brms and 8 more
CVE-2016-6345

RESTEasy: Insufficient use of random values in RESTEasy async jobs could lead to loss of data confidentiality

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Redhat
Products
Resteasy
CVE-2011-5245

RESTEasy: XML eXternal Entity (XXE) flaw

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 6 more
CVE-2021-20293

RESTEasy: PathParam in RESTEasy can lead to a reflected XSS attack

A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Integration Resteasy
CVE-2021-20289

resteasy: Error message exposes endpoint class information

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Netapp Oracle Quarkus and 1 more
Products
Oncommand Insight Communications Cloud Native Core Console Quarkus and 9 more
CVE-2020-25724

resteasy: information disclosure via HTTP response reuse

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Openshift Application Runtimes Resteasy
CVE-2020-25633

resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2020-1695

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Jboss Data Grid and 6 more
CVE-2020-14326

RESTEasy: Caching routes in RootNode may result in DoS

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Camel Quarkus Integration and 4 more
CVE-2020-10688

RESTEasy: RESTEASY003870 exception in RESTEasy can lead to a reflected XSS attack

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fuse Jboss Enterprise Application Platform and 4 more
CVE-2018-1051

resteasy: Unsafe unmarshalling in YamlProvider allows code execution

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.

CVSS 3.0 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Resteasy
CVE-2016-9606

Resteasy: Yaml unmarshalling vulnerable to RCE

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

CVSS 3.0 · 8.1 High EPSS 6.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Enterprise Application Platform Jboss Enterprise Brms Platform and 1 more