Every CVE Search/ Get API key

CVE-2026-89058

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

7.4 HighFix available

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.47%Up 0.1 points since Sep 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.4

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Record
CVE-2026-89058
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-346, CWE-942
Updated
2026-11-06
EUVDEUVD-2026-82736 7.4

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Record
EUVD-2026-82736
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-06
NVD 7.4

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Record
CVE-2026-89058
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-346, CWE-942
Updated
2026-11-06
OSV 7.4

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Record
CVE-2026-89058
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-346
Updated
2026-11-07
OSVDEBIAN-CVE-2026-89058 7.4

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Record
DEBIAN-CVE-2026-89058
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-07
OSVOESA-2026-4304 7.4

resteasy security update

%global desc \ RESTEasy contains a JBoss project that provides frameworks to help\ build RESTful Web Services and RESTful Java applications. It is a fully\ certified and portable implementation of the JAX-RS specification. \ %global extdesc \ \ This package contains

Security Fix(es):

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.(CVE-2026-89058)

Record
OESA-2026-4304
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVOESA-2026-4305 7.4

resteasy security update

%global desc \ RESTEasy contains a JBoss project that provides frameworks to help\ build RESTful Web Services and RESTful Java applications. It is a fully\ certified and portable implementation of the JAX-RS specification. \ %global extdesc \ \ This package contains

Security Fix(es):

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.(CVE-2026-89058)

Record
OESA-2026-4305
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-4306 7.4

resteasy security update

%global desc \ RESTEasy contains a JBoss project that provides frameworks to help\ build RESTful Web Services and RESTful Java applications. It is a fully\ certified and portable implementation of the JAX-RS specification. \ %global extdesc \ \ This package contains

Security Fix(es):

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.(CVE-2026-89058)

Record
OESA-2026-4306
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-4307 7.4

resteasy security update

%global desc \ RESTEasy contains a JBoss project that provides frameworks to help\ build RESTful Web Services and RESTful Java applications. It is a fully\ certified and portable implementation of the JAX-RS specification. \ %global extdesc \ \ This package contains

Security Fix(es):

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.(CVE-2026-89058)

Record
OESA-2026-4307
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:85234 7.5

Red Hat Security Advisory: resteasy security update

Record
RHSA-2026:85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:85234 7.5

Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)

  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:92408 7.5

Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

  • Certificate Authority (CA)
  • Key Recovery Authority (KRA)
  • Online Certificate Status Protocol (OCSP) Manager
  • Token Key Service (TKS)
  • Token Processing Service (TPS)
  • Automatic Certificate Management Environment (ACME) Responder
  • Enrollment over Secure Transport (EST) Responder

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)

  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

  • com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92408
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-89058 7.4

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.

Record
UBUNTU-CVE-2026-89058
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:85234 No score

Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:85234
Updated
2026-11-02
OSVALSA-2026:92408 No score

Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

  • Certificate Authority (CA)
  • Key Recovery Authority (KRA)
  • Online Certificate Status Protocol (OCSP) Manager
  • Token Key Service (TKS)
  • Token Processing Service (TPS)
  • Automatic Certificate Management Environment (ACME) Responder
  • Enrollment over Secure Transport (EST) Responder

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
  • com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92408
Updated
2026-11-02

Affected products

Show 9 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
pki-resteasy-client
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
pki-resteasy-core
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
pki-resteasy-jackson2-provider
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
pki-resteasy-servlet-initializer
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
idm-pki-acme
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-base
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-ca
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-java
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-kra
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-server
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
Show 28 moreShow less
Affected packages
PackageAffectedFixed
idm-pki-tools
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
python3-idm-pki
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
resteasy3.0
Debian:12
 All versions, plus listed versions
3.0.26-6
 None known
resteasy3.0
Debian:13
 All versions, plus listed versions
3.0.26-6
 None known
resteasy3.0
Debian:14
 All versions, plus listed versions
3.0.26-6
 None known
resteasy
openEuler:22.03-LTS-SP4
 before 3.0.19-6.oe2203sp4
3.0.19-6.oe2203sp4
resteasy
openEuler:24.03-LTS-SP1
 before 3.0.19-6.oe2403sp1
3.0.19-6.oe2403sp1
resteasy
openEuler:24.03-LTS-SP3
 before 3.0.19-6.oe2403sp3
3.0.19-6.oe2403sp3
resteasy
openEuler:24.03-LTS-SP4
 before 3.0.19-6.oe2403sp4
3.0.19-6.oe2403sp4
pki-resteasy-client
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
pki-resteasy-core
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
pki-resteasy-jackson2-provider
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
pki-resteasy-servlet-initializer
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
resteasy
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
resteasy
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
dogtag-pki
Rocky Linux:10
From an advisory covering 3 CVEs
 before 0:11.9.0-6.el10_2.1.rocky.0.1
0:11.9.0-6.el10_2.1.rocky.0.1
resteasy
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.0.6-33.0.6-3ubuntu0.1~esm1
 None known
resteasy3.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.0.19-13.0.19-23.0.26-1~18.043.0.26-1~18.04.1~esm1
 None known
resteasy
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2ubuntu0.20.04.1~esm1
 None known
resteasy3.0
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.0.26-13.0.26-1ubuntu0.1~esm1
 None known
resteasy3.0
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.26-23.0.26-33.0.26-3ubuntu0.1
 None known
resteasy
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2ubuntu0.22.04.1~esm1
 None known
resteasy3.0
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.0.26-63.0.26-6ubuntu0.24.04.1
 None known
resteasy
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2ubuntu0.24.04.1~esm1
 None known
resteasy
Ubuntu:26.10
 All versions, plus listed versions
3.6.2-4
 None known
resteasy3.0
Ubuntu:26.10
 All versions, plus listed versions
3.0.26-6
 None known
resteasy
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.2-33.6.2-4
 None known
resteasy3.0
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.26-6
 None known

History

History
RecordedChangedSources
referencesNVD, OSV
products, referencesCVE List
referencesEUVD
referencesOSV
affectedNVD
referencesCVE List
products, referencesEUVD, OSV
referencesEUVD, NVD, OSV
facts, products, referencesCVE List
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-89058 is a high vulnerability (CVSS 7.4) in Red Hat Build Of Apache Camel 3.33.4.redhat, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in resteasy 3.0.19-6.oe2203sp4.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open