CVE-2026-120971
Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
- Record
CVE-2026-120971- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-03
EUVDEUVD-2026-115658
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
- Record
EUVD-2026-115658- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q934-x6mh-3877
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a...
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
- Record
GHSA-q934-x6mh-3877- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-03
NVD
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
- Record
CVE-2026-120971- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-03
OSVDEBIAN-CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
- Record
DEBIAN-CVE-2026-120971- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
- Record
UBUNTU-CVE-2026-120971- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
resteasy3.0Debian:12 |
All versions, plus listed versions 3.0.26-6 |
None known |
resteasy3.0Debian:13 |
All versions, plus listed versions 3.0.26-6 |
None known |
resteasy3.0Debian:14 |
All versions, plus listed versions 3.0.26-6 |
None known |
resteasyUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.0.6-33.0.6-3ubuntu0.1~esm1 |
None known |
resteasy3.0Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.19-13.0.19-23.0.26-1~18.043.0.26-1~18.04.1~esm1 |
None known |
resteasyUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.6.2-23.6.2-2ubuntu0.20.04.1~esm1 |
None known |
resteasy3.0Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.26-13.0.26-1ubuntu0.1~esm1 |
None known |
resteasy3.0Ubuntu:22.04:LTS |
All versions, plus listed versions 3.0.26-23.0.26-33.0.26-3ubuntu0.1 |
None known |
resteasyUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.6.2-23.6.2-2ubuntu0.22.04.1~esm1 |
None known |
resteasy3.0Ubuntu:24.04:LTS |
All versions, plus listed versions 3.0.26-63.0.26-6ubuntu0.24.04.1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
resteasyUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.6.2-23.6.2-2ubuntu0.24.04.1~esm1 |
None known |
resteasyUbuntu:26.10 |
All versions, plus listed versions 3.6.2-4 |
None known |
resteasy3.0Ubuntu:26.10 |
All versions, plus listed versions 3.0.26-6 |
None known |
resteasyUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.2-33.6.2-4 |
None known |
resteasy3.0Ubuntu:26.04:LTS |
All versions, plus listed versions 3.0.26-6 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| published | OSV | |
| affected, aliases, published, references | EUVD, NVD, OSV | |
| facts | CVE List, NVD | |
| published | EUVD | |
| published | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-120971 is a medium vulnerability (CVSS 5.3) in Red Hat Build Of Apache Camel 4 For Quarkus 3, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. No source names a fixed version.