A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apache-commons-collectionsUpgrade python3-nssUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade xerces-j2Upgrade apache-commons-netUpgrade pki-servlet-4.0-apiUpgrade xalan-j2Upgrade javassist-javadocUpgrade bea-stax-apiUpgrade javassistUpgrade glassfish-jaxb-runtimeUpgrade xsomUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade stax-exUpgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade resteasyUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade velocityUpgrade jackson-jaxrs-providersUpgrade pki-servlet-engineUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade xmlstreambufferUpgrade slf4jUpgrade jackson-databind | May 4, 2022 | May 19, 2020 |
| Centos_linux | — | Upgrade pki-servlet-4.0-apiUpgrade pki-toolsUpgrade jakarta-commons-httpclientUpgrade apache-commons-netUpgrade pki-acmeUpgrade javassist-javadocUpgrade pki-caUpgrade jssUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade javassistUpgrade pki-symkeyUpgrade jackson-annotationsUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade relaxngDatatypeUpgrade ldapjdk-javadocUpgrade xalan-j2Upgrade python-nss-docUpgrade pki-symkey-debuginfoUpgrade pki-serverUpgrade pki-kraUpgrade slf4jUpgrade pki-base-javaUpgrade xsomUpgrade apache-commons-collectionsUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade jss-javadocUpgrade python3-pkiUpgrade velocityUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-apiUpgrade pki-core-debuginfoUpgrade stax-exUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade xml-commons-apisUpgrade pki-baseUpgrade xml-commons-resolverUpgrade pki-core-debugsourceUpgrade jackson-databindUpgrade resteasyUpgrade ldapjdkUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-engineUpgrade xerces-j2Upgrade tomcatjss | Jun 1, 2021 | May 19, 2020 |
| Debian | — | Upgrade resteasy3.0 | Jul 30, 2024 | May 19, 2020 |
| Oracle_linux | — | Upgrade xerces-j2Upgrade jss-javadocUpgrade slf4j-jdk14Upgrade velocityUpgrade glassfish-jaxb-coreUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade jackson-jaxrs-providersUpgrade resteasyUpgrade tomcatjssUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade python3-nssUpgrade glassfish-fastinfosetUpgrade stax-exUpgrade xmlstreambufferUpgrade glassfish-jaxb-txw2Upgrade ldapjdkUpgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade pki-baseUpgrade apache-commons-langUpgrade jakarta-commons-httpclientUpgrade apache-commons-netUpgrade pki-symkeyUpgrade pki-acmeUpgrade javassistUpgrade pki-caUpgrade apache-commons-collectionsUpgrade pki-kraUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade pki-base-javaUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade pki-serverUpgrade jssUpgrade ldapjdk-javadocUpgrade pki-servlet-4.0-apiUpgrade python-nss-docUpgrade xalan-j2Upgrade jackson-annotationsUpgrade slf4j | Jul 22, 2024 | Apr 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | May 19, 2020 |
| Redhat_linux | — | Upgrade xerces-j2Upgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade glassfish-fastinfosetUpgrade apache-commons-netUpgrade pki-tools-debuginfoUpgrade pki-symkey-debuginfoUpgrade tomcatjssUpgrade stax-exUpgrade glassfish-jaxb-apiUpgrade apache-commons-langUpgrade resteasyUpgrade bea-stax-apiUpgrade javassistUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade python3-pkiUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade pki-base-javaUpgrade velocityUpgrade javassist-javadocUpgrade pki-serverUpgrade ldapjdkUpgrade jss-javadocUpgrade jakarta-commons-httpclientUpgrade relaxngDatatypeUpgrade python-nss-debugsourceUpgrade pki-kraUpgrade slf4j-jdk14Upgrade pki-caUpgrade python-nss-docUpgrade jackson-coreUpgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade pki-toolsUpgrade python3-nss-debuginfoUpgrade jssUpgrade xml-commons-resolverUpgrade jss-debuginfoUpgrade jackson-databindNo solution existsUpgrade jackson-jaxrs-providersUpgrade pki-core-debugsourceUpgrade pki-servlet-4.0-apiUpgrade jss-debugsourceUpgrade xsomUpgrade pki-baseUpgrade pki-acmeUpgrade pki-symkeyUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade pki-core-debuginfo | May 21, 2021 | May 19, 2020 |
| Rocky_linux | — | Upgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade jssUpgrade jss-debuginfoUpgrade jss-debugsourceUpgrade python3-nss-debuginfoUpgrade jss-javadoc | Mar 12, 2024 | May 19, 2020 |
| Ubuntu | — | Upgrade libresteasy3.0-javaUpgrade libresteasy-javaUpgrade libresteasy-java (Ubuntu Pro)Upgrade libresteasy3.0-java (Ubuntu Pro) | Mar 14, 2025 | May 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub