A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xerces-j2Upgrade python-nss-docUpgrade python3-nssUpgrade xml-commons-resolverUpgrade apache-commons-netUpgrade javassistUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade javassist-javadocUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-apiUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade stax-exUpgrade jackson-annotationsUpgrade velocityUpgrade jackson-databindUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade slf4j-jdk14Upgrade slf4jUpgrade pki-servlet-engineUpgrade resteasyUpgrade jackson-jaxrs-providers | May 4, 2022 | May 19, 2020 |
| Centos_linux | — | Upgrade pki-acmeUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-symkey-debuginfoUpgrade python-nss-docUpgrade xalan-j2Upgrade python3-nss-debuginfoUpgrade pki-symkeyUpgrade pki-serverUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclientUpgrade pki-toolsUpgrade apache-commons-netUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade jss-debuginfoUpgrade slf4jUpgrade apache-commons-collectionsUpgrade jackson-annotationsUpgrade javassistUpgrade jssUpgrade xsomUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade resteasyUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade slf4j-jdk14Upgrade jackson-databindUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-txw2Upgrade stax-exUpgrade pki-core-debuginfoUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-coreUpgrade pki-tools-debuginfoUpgrade tomcatjssUpgrade xerces-j2Upgrade apache-commons-langUpgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade jss-javadocUpgrade velocityUpgrade pki-core-debugsourceUpgrade jackson-coreUpgrade pki-baseUpgrade glassfish-jaxb-runtimeUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade xml-commons-resolverUpgrade python3-nssUpgrade bea-stax-api | Jun 1, 2021 | May 19, 2020 |
| Debian | — | Upgrade resteasy3.0 | Jul 30, 2024 | May 19, 2020 |
| Oracle_linux | — | Upgrade resteasyUpgrade tomcatjssUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-providersUpgrade xml-commons-resolverUpgrade stax-exUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade ldapjdkUpgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade python3-nssUpgrade jackson-coreUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade pki-baseUpgrade python3-pkiUpgrade bea-stax-apiUpgrade glassfish-fastinfosetUpgrade jackson-databindUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-coreUpgrade jss-javadocUpgrade slf4j-jdk14Upgrade xerces-j2Upgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade pki-acmeUpgrade jakarta-commons-httpclientUpgrade python-nss-docUpgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade apache-commons-netUpgrade javassistUpgrade pki-caUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-base-javaUpgrade xsomUpgrade pki-serverUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade pki-kraUpgrade pki-symkeyUpgrade jssUpgrade apache-commons-collectionsUpgrade slf4jUpgrade jackson-annotations | Jul 22, 2024 | Apr 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | May 19, 2020 |
| Redhat_linux | — | Upgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade python3-nssUpgrade pki-caUpgrade pki-acmeNo solution existsUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade pki-kraUpgrade python-nss-debugsourceUpgrade jssUpgrade xml-commons-resolverUpgrade pki-baseUpgrade pki-toolsUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade jss-debuginfoUpgrade xsomUpgrade jackson-coreUpgrade slf4jUpgrade pki-symkeyUpgrade jackson-jaxrs-providersUpgrade python-nss-docUpgrade jackson-jaxrs-json-providerUpgrade python3-nss-debuginfoUpgrade jackson-databindUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade relaxngDatatypeUpgrade jss-javadocUpgrade xmlstreambufferUpgrade pki-serverUpgrade pki-base-javaUpgrade xerces-j2Upgrade jakarta-commons-httpclientUpgrade velocityUpgrade tomcatjssUpgrade python3-pkiUpgrade javassist-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade pki-symkey-debuginfoUpgrade jackson-annotationsUpgrade javassistUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-coreUpgrade ldapjdkUpgrade resteasyUpgrade stax-exUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade xalan-j2Upgrade apache-commons-net | May 21, 2021 | May 19, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade jssUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade jss-javadocUpgrade jss-debuginfoUpgrade jss-debugsourceUpgrade python3-nss-debuginfo | Mar 12, 2024 | May 19, 2020 |
| Ubuntu | — | Upgrade libresteasy3.0-javaUpgrade libresteasy-javaUpgrade libresteasy-java (Ubuntu Pro)Upgrade libresteasy3.0-java (Ubuntu Pro) | Mar 14, 2025 | May 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub