A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade apache-commons-collectionsUpgrade javassistUpgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-4.0-apiUpgrade bea-stax-apiUpgrade python3-nssUpgrade javassist-javadocUpgrade xml-commons-resolverUpgrade xalan-j2Upgrade xerces-j2Upgrade jakarta-commons-httpclientUpgrade glassfish-jaxb-coreUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade apache-commons-langUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-apiUpgrade slf4jUpgrade jackson-coreUpgrade xml-commons-apisUpgrade jackson-annotationsUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade jackson-databindUpgrade resteasyUpgrade pki-servlet-engineUpgrade glassfish-jaxb-runtimeUpgrade velocity | May 4, 2022 | May 19, 2020 |
| Centos_linux | — | Upgrade javassist-javadocUpgrade ldapjdk-javadocUpgrade pki-kraUpgrade apache-commons-netUpgrade pki-acmeUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade javassistUpgrade relaxngDatatypeUpgrade pki-servlet-4.0-apiUpgrade pki-toolsUpgrade jakarta-commons-httpclientUpgrade pki-base-javaUpgrade apache-commons-collectionsUpgrade jss-debuginfoUpgrade jssUpgrade pki-caUpgrade pki-serverUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade pki-symkey-debuginfoUpgrade slf4jUpgrade python-nss-docUpgrade pki-symkeyUpgrade python3-nss-debuginfoUpgrade xalan-j2Upgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade ldapjdkUpgrade xml-commons-resolverUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-engineUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade stax-exUpgrade pki-core-debugsourceUpgrade xml-commons-apisUpgrade jackson-databindUpgrade python3-pkiUpgrade jss-javadocUpgrade glassfish-fastinfosetUpgrade xerces-j2Upgrade tomcatjssUpgrade pki-tools-debuginfoUpgrade bea-stax-apiUpgrade python3-nssUpgrade glassfish-jaxb-runtimeUpgrade jackson-jaxrs-json-provider | Jun 1, 2021 | May 19, 2020 |
| Debian | — | Upgrade resteasy3.0 | Jul 30, 2024 | May 19, 2020 |
| Oracle_linux | — | Upgrade glassfish-jaxb-runtimeUpgrade xml-commons-resolverUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade xml-commons-apisUpgrade pki-baseUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade tomcatjssUpgrade velocityUpgrade jackson-databindUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade jss-javadocUpgrade glassfish-jaxb-apiUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade slf4j-jdk14Upgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade python3-pkiUpgrade apache-commons-langUpgrade python3-nssUpgrade stax-exUpgrade resteasyUpgrade apache-commons-collectionsUpgrade slf4jUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade apache-commons-netUpgrade pki-caUpgrade pki-acmeUpgrade pki-symkeyUpgrade jssUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-base-javaUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade xsomUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade pki-serverUpgrade pki-kraUpgrade python-nss-doc | Jul 22, 2024 | Apr 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | May 19, 2020 |
| Redhat_linux | — | Upgrade pki-tools-debuginfoUpgrade javassist-javadocUpgrade apache-commons-netUpgrade xml-commons-apisUpgrade xalan-j2Upgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade stax-exUpgrade ldapjdk-javadocUpgrade resteasyUpgrade glassfish-jaxb-txw2Upgrade jackson-annotationsUpgrade jss-javadocUpgrade javassistUpgrade relaxngDatatypeUpgrade pki-servlet-engineUpgrade pki-base-javaUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade pki-symkey-debuginfoUpgrade pki-baseUpgrade python-nss-debugsourceUpgrade pki-toolsUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade apache-commons-langUpgrade xerces-j2Upgrade bea-stax-apiUpgrade ldapjdkUpgrade pki-serverUpgrade jakarta-commons-httpclientUpgrade tomcatjssUpgrade velocity | May 21, 2021 | May 19, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python3-nssUpgrade jssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade jss-javadocUpgrade jss-debugsourceUpgrade jss-debuginfo | Mar 12, 2024 | May 19, 2020 |
| Ubuntu | — | Upgrade libresteasy-java (Ubuntu Pro)Upgrade libresteasy3.0-java (Ubuntu Pro)Upgrade libresteasy-javaUpgrade libresteasy3.0-java | Mar 14, 2025 | May 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub