What happened
Organisations running affected versions of RESTEasy may be vulnerable to a remote information disclosure vulnerability identified as CVE-2026-120971. The issue arises because RESTEasy's default exception mapper can return a detailed, localized exception message in the HTTP 500 response body when an application does not have a custom exception mapper that handles unhandled exceptions other than WebApplicationException. This behaviour allows a remote unauthenticated client to trigger such an exception and receive potentially sensitive information included in the message. Reports indicate that the vulnerability has been demonstrated with RESTEasy version 7.0.2.Final; however, the complete scope of affected and fixed versions remains to be confirmed.
Who is affected
Impact extends to deployments using the Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat build of Quarkus, Red Hat Red Hat Fuse 7, Red Hat Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Red Hat Satellite 6. These components may be exposed to the vulnerability if their services are reachable remotely over a network, with none of the affected applications requiring prior access or user interactions.
Recommended actions
- Assess network exposure: Restrict access to affected services through firewalls, network segmentation, or access control mechanisms.
- Implement network controls: Ensure that only trusted sources can communicate with applicable services to prevent unauthenticated triggering of exceptions.
- Apply security updates: Monitor vendor advisories for patches or mitigations that address this vulnerability; apply patches as they become available.
