{"id":"CVE-2026-120971","kind":"vulnerability","aliases":["CVE-2026-120971"],"related":[],"title":"RESTEasy: default exception mapper leaks error messages in HTTP 500 responses","description":"RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed.","summary":"RESTEasy's default exception mapper puts an exception's localized message into the body of HTTP 500 responses when no application mapper handles the error. A remote, unauthenticated client who can trigger such an exception may read information contained in that message.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-rest","java","package","resteasy"],"not_affected_if":["custom-exception-mapper","generic-error-responses"],"how_to_check":"- Look for the `resteasy` dependency in the build file and note the version in use.\n- Reproduce an unhandled, non-WebApplicationException error on a test endpoint and inspect whether the 500 response body contains the exception message.\n- Check whether the application registers its own exception mappers for unhandled exceptions.","fix":null,"status":"open","published_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:58+00:00","updated_at":"2026-11-03T05:49:58+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T05:49:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"RESTEasy: default exception mapper leaks error messages in HTTP 500 responses","impact":"low","summary":"RESTEasy's default exception mapper puts an exception's localized message into the body of HTTP 500 responses when no application mapper handles the error. A remote, unauthenticated client who can trigger such an exception may read information contained in that message.","audience":"developers","category":"package","nicknames":[],"who_cares":["resteasy","java","jakarta-rest"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"exception messages with internal details returned to unauthenticated clients","analyst_note":"Confirm affected and fixed RESTEasy version ranges and the upstream fix from the NVD entry or the project advisory.","how_to_check":"- Look for the `resteasy` dependency in the build file and note the version in use.\n- Reproduce an unhandled, non-WebApplicationException error on a test endpoint and inspect whether the 500 response body contains the exception message.\n- Check whether the application registers its own exception mappers for unhandled exceptions.","plain_action":"","needs_analyst":true,"not_affected_if":["custom-exception-mapper","generic-error-responses"],"who_is_affected":"Applications built on RESTEasy that do not register their own mapper for unhandled exceptions can return exception messages to clients. The sources report reproduction with RESTEasy 7.0.2.Final, but the full affected and fixed version ranges are not yet confirmed. Teams that map all unhandled exceptions to generic responses are likely not exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4172,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120971':14A,17A '-2026':13A,16A '500':10A,40B,80C '7.0.2.final':121C 'affect':124C 'applic':44B,85C 'behavior':118C 'bodi':37B,82C 'burzigotti':114C 'client':52B,99C 'complet':123C 'confirm':132C 'contain':62B 'cve':12A,15A 'default':2A,26B,68C 'error':6A,48B 'except':3A,27B,31B,58B,69C,73C,86C,91C,105C 'fabio':113C 'fix':126C 'handl':46B,88C 'http':9A,39B,79C 'includ':109C 'inform':61B,108C 'jakarta':19B 'jakarta-rest':18B 'java':21B 'leak':5A 'local':33B,75C 'mapper':4A,28B,45B,70C,87C 'may':59B,106C 'messag':7A,34B,65B,76C,112C 'packag':22B 'put':29B 'rang':128C 'read':60B 'receiv':107C 'remain':129C 'remot':50B,97C 'report':115C 'reproduc':116C 'respons':11A,41B,81C 'rest':20B 'resteasi':1A,23B,24B,66C,120C 'return':71C 'trigger':55B,102C 'unauthent':51B,98C 'unhandl':90C 'version':127C 'webapplicationexcept':95C","nicknames":[],"mitigations":[],"who_affected":"Applications built on RESTEasy that do not register their own mapper for unhandled exceptions can return exception messages to clients. The sources report reproduction with RESTEasy 7.0.2.Final, but the full affected and fixed version ranges are not yet confirmed. Teams that map all unhandled exceptions to generic responses are likely not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jakartarest","java","medium","package","resteasy"],"first_public_at":"2026-11-03T05:18:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120971","severity":null,"published_at":"2026-11-03T05:18:34+00:00","modified_at":"2026-11-03T05:18:34+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}