Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120971— Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

Quick assessment

Affected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RESTEasy 的默认异常映射器会在 HTTP 500 响应体中返回异常的本地化消息，前提是未发生 WebApplicationException 且没有其他应用程序异常映射器处理该未捕获的异常。远程未认证的攻击者若能触发此类异常，便可能获取消息中包含的敏感信息。Fabio Burzigotti 报告称，该行为可在 RESTEasy 7.0.2.Final 中复现。目前，受影响的版本范围及已修复的版本范围仍有待进一步确认。

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120971

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 - cpe:/a:redhat:camel_quarkus:3
Red Hat Red Hat build of Apicurio Registry 3 - cpe:/a:redhat:apicurio_registry:3
Red Hat Red Hat build of Debezium 3 - cpe:/a:redhat:debezium:3
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat build of Quarkus - cpe:/a:redhat:quarkus:3
Red Hat Red Hat Fuse 7 - cpe:/a:redhat:jboss_fuse:7
Red Hat Red Hat JBoss Enterprise Application Platform 8 - cpe:/a:redhat:jboss_enterprise_application_platform:8
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack - cpe:/a:redhat:jbosseapxp
Red Hat Red Hat Satellite 6 - cpe:/a:redhat:satellite:6

II. Public POCs for CVE-2026-120971

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120971

请登录查看更多情报信息。

Other References for CVE-2026-120971 (2)

Same Patch Batch · Red Hat · 2026-11-03 · 3 CVEs total

CVE-2026-120830 7.4 HIGH Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information
CVE-2026-120831 6.5 MEDIUM Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

IV. Related Vulnerabilities

Same product: Red Hat build of Apache Camel 4 for Quarkus 3
Same vendor: Red Hat
Same weakness: CWE-209