A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade javassistUpgrade apache-commons-netUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xerces-j2Upgrade javassist-javadocUpgrade bea-stax-apiUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade python3-nssUpgrade xalan-j2Upgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade resteasyUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade velocityUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-provider | May 4, 2022 | May 19, 2020 |
| Centos_linux | — | Upgrade slf4j-jdk14Upgrade xmlstreambufferUpgrade apache-commons-langUpgrade jss-javadocUpgrade ldapjdkUpgrade python3-pkiUpgrade xerces-j2Upgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade tomcatjssUpgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade pki-core-debugsourceUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade pki-core-debuginfoUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade python3-nssUpgrade velocityUpgrade jackson-databindUpgrade resteasyUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-providersUpgrade jackson-jaxrs-json-providerUpgrade pki-baseUpgrade xml-commons-resolverUpgrade jackson-module-jaxb-annotationsUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade jssUpgrade pki-base-javaUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade pki-acmeUpgrade pki-caUpgrade pki-servlet-4.0-apiUpgrade pki-symkey-debuginfoUpgrade python-nss-docUpgrade xalan-j2Upgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade pki-serverUpgrade javassistUpgrade jackson-annotationsUpgrade jss-debuginfoUpgrade apache-commons-collectionsUpgrade pki-toolsUpgrade apache-commons-netUpgrade slf4jUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade xsomUpgrade relaxngDatatype | Jun 1, 2021 | May 19, 2020 |
| Debian | — | Upgrade resteasy3.0 | Jul 30, 2024 | May 19, 2020 |
| Oracle_linux | — | Upgrade jackson-jaxrs-providersUpgrade resteasyUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade velocityUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade xmlstreambufferUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-coreUpgrade jss-javadocUpgrade slf4j-jdk14Upgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade xerces-j2Upgrade python3-nssUpgrade pki-baseUpgrade stax-exUpgrade jackson-coreUpgrade tomcatjssUpgrade python3-pkiUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-symkeyUpgrade python-nss-docUpgrade pki-acmeUpgrade jssUpgrade javassist-javadocUpgrade pki-caUpgrade slf4jUpgrade jackson-annotationsUpgrade apache-commons-netUpgrade apache-commons-collectionsUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade xsomUpgrade pki-serverUpgrade pki-kraUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2 | Jul 22, 2024 | Apr 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | May 19, 2020 |
| Redhat_linux | — | Upgrade jss-javadocUpgrade xmlstreambufferUpgrade ldapjdkUpgrade apache-commons-langUpgrade javassist-javadocUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade pki-tools-debuginfoUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade tomcatjssUpgrade relaxngDatatypeUpgrade stax-exUpgrade pki-base-javaUpgrade xerces-j2Upgrade apache-commons-netUpgrade python3-pkiUpgrade xalan-j2Upgrade pki-serverUpgrade jakarta-commons-httpclientUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade jackson-annotationsUpgrade javassistUpgrade xml-commons-apisUpgrade pki-symkey-debuginfoUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade pki-caUpgrade pki-core-debugsourceNo solution existsUpgrade pki-kraUpgrade pki-acmeUpgrade xsomUpgrade slf4jUpgrade python3-nssUpgrade jss-debuginfoUpgrade pki-symkeyUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade jss-debugsourceUpgrade slf4j-jdk14Upgrade python-nss-debugsourceUpgrade pki-toolsUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade jssUpgrade jackson-core | May 21, 2021 | May 19, 2020 |
| Rocky_linux | — | Upgrade jss-debugsourceUpgrade jss-debuginfoUpgrade python3-nss-debuginfoUpgrade jss-javadocUpgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade jss | Mar 12, 2024 | May 19, 2020 |
| Ubuntu | — | Upgrade libresteasy3.0-java (Ubuntu Pro)Upgrade libresteasy-java (Ubuntu Pro)Upgrade libresteasy-javaUpgrade libresteasy3.0-java | Mar 14, 2025 | May 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub