A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-nssUpgrade apache-commons-netUpgrade bea-stax-apiUpgrade jakarta-commons-httpclientUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade pki-servlet-4.0-apiUpgrade javassistUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade xerces-j2Upgrade glassfish-jaxb-txw2Upgrade xalan-j2Upgrade javassist-javadocUpgrade velocityUpgrade slf4j-jdk14Upgrade pki-servlet-engineUpgrade xml-commons-apisUpgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade slf4jUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade jackson-annotationsUpgrade apache-commons-langUpgrade jackson-jaxrs-providersUpgrade xmlstreambufferUpgrade glassfish-jaxb-apiUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade jackson-core | May 4, 2022 | May 19, 2020 |
| Centos_linux | — | Upgrade pki-kraUpgrade pki-acmeUpgrade apache-commons-netUpgrade jackson-module-jaxb-annotationsUpgrade jss-debugsourceUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade pki-base-javaUpgrade pki-caUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade python3-nss-debuginfoUpgrade javassistUpgrade pki-symkey-debuginfoUpgrade pki-symkeyUpgrade jackson-annotationsUpgrade jssUpgrade pki-serverUpgrade python-nss-docUpgrade pki-toolsUpgrade xalan-j2Upgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade jss-debuginfoUpgrade relaxngDatatypeUpgrade javassist-javadocUpgrade xsomUpgrade glassfish-fastinfosetUpgrade tomcatjssUpgrade pki-tools-debuginfoUpgrade xerces-j2Upgrade jackson-databindUpgrade xml-commons-apisUpgrade pki-core-debugsourceUpgrade pki-baseUpgrade python3-nssUpgrade bea-stax-apiUpgrade glassfish-jaxb-txw2Upgrade pki-servlet-engineUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade velocityUpgrade xmlstreambufferUpgrade slf4j-jdk14Upgrade apache-commons-langUpgrade python3-pkiUpgrade jss-javadocUpgrade resteasyUpgrade xml-commons-resolverUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade ldapjdkUpgrade jackson-jaxrs-providers | Jun 1, 2021 | May 19, 2020 |
| Debian | — | Upgrade resteasy3.0 | Jul 30, 2024 | May 19, 2020 |
| Oracle_linux | — | Upgrade python3-nssUpgrade jackson-coreUpgrade xml-commons-resolverUpgrade velocityUpgrade pki-servlet-engineUpgrade jackson-jaxrs-json-providerUpgrade xmlstreambufferUpgrade pki-baseUpgrade glassfish-jaxb-apiUpgrade stax-exUpgrade jackson-databindUpgrade bea-stax-apiUpgrade jss-javadocUpgrade apache-commons-langUpgrade python3-pkiUpgrade xml-commons-apisUpgrade ldapjdkUpgrade resteasyUpgrade jackson-jaxrs-providersUpgrade glassfish-fastinfosetUpgrade slf4j-jdk14Upgrade glassfish-jaxb-txw2Upgrade tomcatjssUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade apache-commons-collectionsUpgrade slf4jUpgrade pki-kraUpgrade pki-servlet-4.0-apiUpgrade pki-acmeUpgrade ldapjdk-javadocUpgrade python-nss-docUpgrade pki-symkeyUpgrade jssUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade xsomUpgrade pki-serverUpgrade pki-caUpgrade jackson-annotationsUpgrade apache-commons-netUpgrade pki-base-javaUpgrade relaxngDatatypeUpgrade pki-toolsUpgrade xalan-j2 | Jul 22, 2024 | Apr 15, 2020 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 15, 2020 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | May 19, 2020 |
| Redhat_linux | — | Upgrade pki-core-debuginfoUpgrade jackson-jaxrs-providersUpgrade jackson-databindUpgrade pki-kraUpgrade python3-nss-debuginfoUpgrade jssUpgrade pki-caUpgrade slf4jUpgrade jackson-jaxrs-json-providerUpgrade xsomUpgrade jss-debugsourceUpgrade python3-nssUpgrade pki-toolsUpgrade glassfish-jaxb-runtimeNo solution existsUpgrade python-nss-debugsourceUpgrade jss-debuginfoUpgrade pki-core-debugsourceUpgrade pki-servlet-4.0-apiUpgrade xml-commons-resolverUpgrade python-nss-docUpgrade pki-symkeyUpgrade pki-acmeUpgrade pki-baseUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade javassist-javadocUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade bea-stax-apiUpgrade apache-commons-langUpgrade velocityUpgrade glassfish-jaxb-coreUpgrade tomcatjssUpgrade xml-commons-apisUpgrade pki-serverUpgrade apache-commons-netUpgrade xmlstreambufferUpgrade ldapjdk-javadocUpgrade xerces-j2Upgrade python3-pkiUpgrade glassfish-jaxb-apiUpgrade resteasyUpgrade jakarta-commons-httpclientUpgrade javassistUpgrade xalan-j2Upgrade pki-tools-debuginfoUpgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade glassfish-fastinfosetUpgrade ldapjdkUpgrade pki-symkey-debuginfoUpgrade pki-base-javaUpgrade jackson-annotations | May 21, 2021 | May 19, 2020 |
| Rocky_linux | — | Upgrade jss-debugsourceUpgrade jss-debuginfoUpgrade jss-javadocUpgrade python3-nss-debuginfoUpgrade jssUpgrade python3-nssUpgrade python-nss-debugsourceUpgrade python-nss-doc | Mar 12, 2024 | May 19, 2020 |
| Ubuntu | — | Upgrade libresteasy3.0-javaUpgrade libresteasy-javaUpgrade libresteasy3.0-java (Ubuntu Pro)Upgrade libresteasy-java (Ubuntu Pro) | Mar 14, 2025 | May 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub