{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120971", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-11-03T04:01:17.695Z", "datePublished": "2026-11-03T04:16:03.089Z", "dateUpdated": "2026-11-03T04:16:03.089Z"}, "containers": {"cna": {"title": "Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:camel_quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apicurio_registry:3"]}, {"vendor": "Red Hat", "product": "Red Hat build of Debezium 3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:debezium:3"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}, {"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbk/keycloak-rhel9-operator", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:build_keycloak:"]}, {"vendor": "Red Hat", "product": "Red Hat build of Quarkus", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:quarkus:3"]}, {"vendor": "Red Hat", "product": "Red Hat Fuse 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "resteasy-core", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:jboss_fuse:7"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"]}, {"vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "resteasy-core", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:jbosseapxp"]}, {"vendor": "Red Hat", "product": "Red Hat Satellite 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "candlepin", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:satellite:6"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-120971", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565584", "name": "RHBZ#2565584", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-03T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-209: Generation of Error Message Containing Sensitive Information", "timeline": [{"lang": "en", "time": "2026-09-28T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-03T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Yu Bao (PayPal Cyber Security Team) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-03T04:16:03.089Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{}

{}