A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xalan-j2Upgrade bea-stax-apiUpgrade apache-commons-netUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade xerces-j2Upgrade python-nss-docUpgrade jackson-coreUpgrade velocityUpgrade slf4j-jdk14Upgrade stax-exUpgrade jackson-jaxrs-providersUpgrade resteasyUpgrade jackson-module-jaxb-annotationsUpgrade jackson-databindUpgrade xsomUpgrade glassfish-jaxb-apiUpgrade glassfish-jaxb-runtimeUpgrade xml-commons-apisUpgrade slf4jUpgrade pki-servlet-engineUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade jackson-annotations | May 4, 2022 | May 19, 2020 |
| Centos_linux | — | Upgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade pki-core-debuginfoUpgrade xmlstreambufferUpgrade stax-exUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade tomcatjssUpgrade jackson-databindUpgrade xerces-j2Upgrade jss-javadocUpgrade python3-pkiUpgrade pki-baseUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade jackson-coreUpgrade bea-stax-apiUpgrade pki-core-debugsourceUpgrade glassfish-jaxb-coreUpgrade apache-commons-langUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade xml-commons-apisUpgrade ldapjdkUpgrade python-nss-debugsourceUpgrade pki-toolsUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade pki-acmeUpgrade apache-commons-netUpgrade slf4jUpgrade apache-commons-collectionsUpgrade jakarta-commons-httpclientUpgrade jss-debuginfoUpgrade javassistUpgrade javassist-javadocUpgrade pki-symkeyUpgrade xalan-j2Upgrade pki-base-javaUpgrade pki-kraUpgrade jss-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade jssUpgrade pki-symkey-debuginfoUpgrade python-nss-docUpgrade python3-nss-debuginfoUpgrade pki-serverUpgrade jackson-annotationsUpgrade xsomUpgrade ldapjdk-javadocUpgrade relaxngDatatype | Jun 1, 2021 | May 19, 2020 |
| Debian | — | Upgrade resteasy3.0 | Jul 30, 2024 | May 19, 2020 |
| Oracle_linux | — | Upgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade slf4j-jdk14Upgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade xml-commons-apisUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade python3-nssUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade jackson-databindUpgrade jss-javadocUpgrade stax-exUpgrade glassfish-jaxb-runtimeUpgrade jackson-coreUpgrade resteasyUpgrade pki-servlet-engineUpgrade tomcatjssUpgrade velocityUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade glassfish-jaxb-apiUpgrade pki-baseUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade jssUpgrade xalan-j2Upgrade pki-acmeUpgrade pki-servlet-4.0-apiUpgrade pki-serverUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade jackson-annotationsUpgrade pki-toolsUpgrade pki-kraUpgrade pki-base-javaUpgrade ldapjdk-javadocUpgrade python-nss-docUpgrade slf4jUpgrade apache-commons-netUpgrade pki-caUpgrade javassistUpgrade relaxngDatatypeUpgrade jakarta-commons-httpclient | Jul 22, 2024 | Apr 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | May 19, 2020 |
| Redhat_linux | — | Upgrade pki-acmeUpgrade jss-debuginfoUpgrade jackson-jaxrs-providersUpgrade glassfish-jaxb-runtimeUpgrade pki-symkeyUpgrade slf4jUpgrade jss-debugsourceUpgrade pki-baseUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade pki-core-debugsourceUpgrade apache-commons-collectionsUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade slf4j-jdk14Upgrade pki-kraUpgrade python3-nss-debuginfoNo solution existsUpgrade jssUpgrade python-nss-debugsourceUpgrade xsomUpgrade python3-nssUpgrade xml-commons-resolverUpgrade pki-caUpgrade python-nss-docUpgrade jackson-coreUpgrade jackson-jaxrs-json-providerUpgrade javassist-javadocUpgrade resteasyUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade apache-commons-langUpgrade ldapjdk-javadocUpgrade python3-pkiUpgrade xml-commons-apisUpgrade bea-stax-apiUpgrade tomcatjssUpgrade relaxngDatatypeUpgrade velocityUpgrade ldapjdkUpgrade glassfish-fastinfosetUpgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade jakarta-commons-httpclientUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade pki-base-javaUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade glassfish-jaxb-coreUpgrade pki-serverUpgrade jss-javadocUpgrade xalan-j2Upgrade javassistUpgrade apache-commons-net | May 21, 2021 | May 19, 2020 |
| Rocky_linux | — | Upgrade jssUpgrade python3-nssUpgrade python-nss-docUpgrade python-nss-debugsourceUpgrade jss-javadocUpgrade python3-nss-debuginfoUpgrade jss-debuginfoUpgrade jss-debugsource | Mar 12, 2024 | May 19, 2020 |
| Ubuntu | — | Upgrade libresteasy-java (Ubuntu Pro)Upgrade libresteasy-javaUpgrade libresteasy3.0-java (Ubuntu Pro)Upgrade libresteasy3.0-java | Mar 14, 2025 | May 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub