Live › vulnerability › CVE-2026-120971
RESTEasy's default exception mapper puts an exception's localized message into the body of HTTP 500 responses when no application mapper handles the error. A remote, unauthenticated client who can trigger such an exception may read information contained in that message.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Applications built on RESTEasy that do not register their own mapper for unhandled exceptions can return exception messages to clients. The sources report reproduction with RESTEasy 7.0.2.Final, but the full affected and fixed version ranges are not yet confirmed. Teams that map all unhandled exceptions to generic responses are likely not exposed.
No product ranges from the sources yet.
resteasy dependency in the build file and note the version in use.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed.
This page as .md · .json · in your agent: get_signal("CVE-2026-120971")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.