{"id":"CVE-2024-9622","aliases":["EUVD-2024-2955","GHSA-5wpr-cj9p-959r","UBUNTU-CVE-2024-9622","USN-7351-1","USN-7630-1"],"status":"published","title":"Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00649,"percentile":0.51399,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2024-10-08T16:26:13Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-netty4-cdi","fixed_in":["7.0.0.Alpha3"],"sources":["ghsa"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","fixed_in":["3.0.6-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"resteasy3.0","fixed_in":["3.0.26-1~18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy","fixed_in":["3.6.2-2ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy3.0","fixed_in":["3.0.26-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"resteasy3.0","fixed_in":["3.0.26-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"resteasy","fixed_in":["3.6.2-2ubuntu0.22.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"resteasy3.0","fixed_in":["3.0.26-6ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"resteasy","fixed_in":["3.6.2-2ubuntu0.24.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-netty4-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0.Alpha3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jboss.resteasy:resteasy-netty4-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.10.Final","3.0.11.Final","3.0.12.Final","3.0.13.Final","3.0.14.Final","3.0.15.Final","3.0.16.Final","3.0.17.Final","3.0.18.Final","3.0.19.Final","3.0.20.Final","3.0.21.Final","3.0.22.Final","3.0.23.Final","3.0.24.Final","3.0.26.Final","3.0.7.Final","3.0.8.Final","3.0.9.Final","3.1.0.Beta1","3.1.0.Beta2","3.1.0.CR1","3.1.0.CR2","3.1.0.CR3","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.1.4.Final","3.10.0.Final","3.11.0.Final","3.11.1.Final","3.11.2.Final","3.11.3.Final","3.11.4.Final","3.11.5.Final","3.12.0.Final","3.12.1.Final","3.13.0.Final","3.13.1.Final","3.13.2.Final","3.14.0.Final","3.15.0.Alpha1","3.15.0.Final","3.15.1.Final","3.15.2.Final","3.15.3.Final","3.15.6.Final","3.5.0.CR1","3.5.0.CR2","3.5.0.CR3","3.5.0.CR4","3.5.0.Final","3.5.1.Final","3.6.0.CR1","3.6.0.Final","3.6.1.Final","3.6.1.SP1","3.6.1.SP2","3.6.1.SP3","3.6.1.SP5","3.6.1.SP6","3.6.1.SP7","3.6.1.SP8","3.6.2.Final","3.6.3.Final","3.6.3.SP1","3.7.0.Final","3.8.0.Final","3.8.1.Final","3.9.0.Final","3.9.1.Final","3.9.2.Final","3.9.3.Final","3.9.3.SP1","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.Beta4","4.0.0.Beta5","4.0.0.Beta6","4.0.0.Beta7","4.0.0.Beta8","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.Final","4.1.0.Final","4.1.1.Final","4.2.0.Final","4.3.0.Final","4.3.1.Final","4.4.0.CR1","4.4.0.Final","4.4.1.Final","4.4.2.Final","4.4.3.Final","4.5.0.Final","4.5.1.Final","4.5.10.Final","4.5.11.Final","4.5.12.Beta1","4.5.12.Final","4.5.2.Final","4.5.3.Final","4.5.4.Final","4.5.5.Final","4.5.6.Final","4.5.7.Final","4.5.8.Final","4.5.8.SP1","4.5.9.Final","4.6.0.Final","4.6.1.Alpha1","4.6.1.Beta1","4.6.1.Beta2","4.6.1.Beta3","4.6.1.Beta5","4.6.1.Beta6","4.6.1.Beta7","4.6.1.Beta8","4.6.1.Beta9","4.6.1.Final","4.6.2.Final","4.7.0.Beta1","4.7.0.Beta2","4.7.0.Beta3","4.7.0.Beta6","4.7.0.Beta7","4.7.0.Final","4.7.1.Final","4.7.10.Final","4.7.2.Final","4.7.3.Final","4.7.4.Final","4.7.5.Final","4.7.6.Final","4.7.7.Final","4.7.8.Final","4.7.9.Final","5.0.0.Alpha1","5.0.0.Beta1","5.0.0.Beta2","5.0.0.Beta3","5.0.0.Final","5.0.1.Final","5.0.10.Final","5.0.2.Final","5.0.3.Final","5.0.4.Final","5.0.5.Final","5.0.6.Final","5.0.7.Final","5.0.8.Final","5.0.9.Final","6.0.0.Beta1","6.0.0.Final","6.0.1.Final","6.0.2.Final","6.0.3.Final","6.1.0.Alpha1","6.1.0.Beta1","6.1.0.Beta2","6.1.0.Beta3","6.1.0.Final","6.2.0.Beta1","6.2.0.Final","6.2.1.Final","6.2.10.Final","6.2.11.Final","6.2.12.Final","6.2.14.Beta1","6.2.14.Final","6.2.15.Final","6.2.16.Final","6.2.17.Final","6.2.18.Final","6.2.2.Final","6.2.3.Final","6.2.4.Final","6.2.5.Final","6.2.6.Final","6.2.7.Final","6.2.8.Final","6.2.9.Final","7.0.0.Alpha1","7.0.0.Alpha2","7.0.0.Alpha3","7.0.0.Alpha4","7.0.0.Beta1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-3ubuntu0.1~esm1"}]}],"versions":["3.0.6-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1~18.04.1~esm1"}]}],"versions":["3.0.19-1","3.0.19-2","3.0.26-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2ubuntu0.20.04.1~esm1"}]}],"versions":["3.6.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1ubuntu0.1~esm1"}]}],"versions":["3.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-3ubuntu0.1"}]}],"versions":["3.0.26-2","3.0.26-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2ubuntu0.22.04.1~esm1"}]}],"versions":["3.6.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-6ubuntu0.24.04.1"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2ubuntu0.24.04.1~esm1"}]}],"versions":["3.6.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-3","3.6.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2ubuntu0.20.04.1~esm1"}]}],"versions":["3.6.2-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2ubuntu0.22.04.1~esm1"}]}],"versions":["3.6.2-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-2ubuntu0.24.04.1~esm1"}]}],"versions":["3.6.2-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-3ubuntu0.1~esm1"}]}],"versions":["3.0.6-3"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1~18.04.1~esm1"}]}],"versions":["3.0.19-1","3.0.19-2","3.0.26-1~18.04"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-1ubuntu0.1~esm1"}]}],"versions":["3.0.26-1"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-3ubuntu0.1"}]}],"versions":["3.0.26-2","3.0.26-3"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-6ubuntu0.24.04.1"}]}],"versions":["3.0.26-6"],"bundled":11}],"products":[{"vendor":"red hat","product":"red hat jboss data grid 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-9622","tags":["vdb-entry","x_refsource_REDHAT","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317179","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/orgs/resteasy/discussions/4351","tags":["web","report"]},{"url":"https://github.com/resteasy/resteasy","tags":["package","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9622","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5wpr-cj9p-959r"},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9622.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-9622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-9622","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7351-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7630-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-1695","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-10688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25633","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20289","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0482","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7050","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-9622","title":"Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T16:26:13.413Z","modified":"2025-11-21T07:28:36.663Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:05.823187Z"}],"euvd":[{"id":"EUVD-2024-2955","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T16:26:13Z","modified":"2025-11-21T07:28:36Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:14.058235Z"}],"ghsa":[{"id":"GHSA-5wpr-cj9p-959r","title":"HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T18:33:14Z","modified":"2024-10-08T22:23:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2024-9622","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T17:15:57.79Z","modified":"2026-06-17T08:24:56.2Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:10:31.271525Z"}],"osv":[{"id":"CVE-2024-9622","title":"Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T16:26:13.413Z","modified":"2026-10-28T02:30:31.142615234Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"GHSA-5wpr-cj9p-959r","title":"HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T18:33:14Z","modified":"2026-09-10T03:50:19.332553195Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"UBUNTU-CVE-2024-9622","description":"A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.","status":"published","published":"2024-10-08T17:15:00Z","modified":"2026-10-17T12:56:59.662519596Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"USN-7351-1","title":"resteasy vulnerabilities","description":"Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding\nwhen certain errors occur. An attacker could possibly use this issue to\nmodify the app's behavior for other users through the network.\n(CVE-2020-10688)\n\nMirko Selber discovered that RESTEasy improperly validated user input\nduring HTTP response construction. This issue could possibly allow an\nattacker to cause a denial of service or execute arbitrary code.\n(CVE-2020-1695)\n\nIt was discovered that RESTEasy unintentionally disclosed potentially\nsensitive server information to users during the handling of certain\nerrors. (CVE-2020-25633)\n\nIt was discovered that RESTEasy unintentionally disclosed parts of its code\nto users during the handling of certain errors. (CVE-2021-20289)\n\nIt was discovered that RESTEasy used improper permissions when creating\ntemporary files. An attacker could possibly use this issue to get access to\nsensitive data. (CVE-2023-0482)\n\nIt was discovered that RESTEasy improperly handled certain HTTP requests\nand could be forced into a state in which it can no longer accept incoming\nconnections. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2024-9622)\n","status":"published","published":"2025-03-13T14:45:05Z","modified":"2026-04-27T17:49:32.203322Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7630-1","title":"resteasy, resteasy3.0 vulnerabilities","description":"It was discovered that RESTEasy made insufficient use of random values in\nasynchronous jobs. An attacker could possibly use this issue to steal\nuser data. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6345)\n\nIt was discovered that RESTEasy enabled a vulnerable GZIP decompression\nmodule by default. An attacker could possibly use this issue to cause a\ndenial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2016-6346)\n\nIt was discovered that RESTEasy improperly made use of unsanitized data\nwhile handling certain errors. An attacker could possibly use this issue\nto cause a denial of service or execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-6347)\n\nIt was discovered that RESTEasy enabled a vulnerable JSON manipulation\nmodule by default. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-6348)\n\nIt was discovered that RESTEasy enabled a vulnerable deserialization\nmodule by default. An attacker could possibly use this issue to cause a\ndenial of service or execute arbitrary code.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2016-7050)\n\nNikos Papadopoulos discovered that RESTEasy improperly handled URL encoding\nwhen certain errors occur. An attacker could possibly use this issue to\nmodify the app's behavior for other users throughout the network.\nThis issue did not affect resteasy3.0 in Ubuntu 24.04 LTS, Ubuntu 24.10,\nand Ubuntu 25.04. (CVE-2020-10688)\n\nMirko Selber discovered that RESTEasy improperly validated user input\nduring HTTP response construction. An attacker could possibly use this\nissue to to cause a denial of service or execute arbitrary code.\nThis issue did not affect resteasy3.0 in Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2020-1695)\n\nIt was discovered that RESTEasy improperly handled receiving the\nWebApplicationException during a client call. An attacker could possibly\nuse this issue to obtain potentially sensitive server information.\n(CVE-2020-25633)\n\nIt was discovered that RESTEasy improperly populated exception responses\nwith endpoint class and method names. An attacker could possibly use this\nissue to obtain potentially sensitive server information. (CVE-2021-20289)\n\nIt was discovered that RESTEasy used improper permissions when creating\ntemporary files. An attacker could possibly use this issue to get access to\nsensitive data. (CVE-2023-0482)\n\nIt was discovered that RESTEasy improperly handled certain HTTP requests\ncontaining ASCII control characters. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2024-9622)","status":"published","published":"2025-07-10T14:30:24Z","modified":"2026-06-25T13:32:30.622146855Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}