---
id: "CVE-2026-120971"
kind: "vulnerability"
aliases: ["CVE-2026-120971"]
title: "RESTEasy: default exception mapper leaks error messages in HTTP 500 responses"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jakarta-rest", "java", "package", "resteasy"]
not_affected_if: ["custom-exception-mapper", "generic-error-responses"]
published_at: "2026-11-03T05:18:34+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:49:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120971", "first_seen_at": "2026-11-03T05:48:53+00:00"}]
---

# RESTEasy: default exception mapper leaks error messages in HTTP 500 responses

RESTEasy's default exception mapper puts an exception's localized message into the body of HTTP 500 responses when no application mapper handles the error. A remote, unauthenticated client who can trigger such an exception may read information contained in that message.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the `resteasy` dependency in the build file and note the version in use.
- Reproduce an unhandled, non-WebApplicationException error on a test endpoint and inspect whether the 500 response body contains the exception message.
- Check whether the application registers its own exception mappers for unhandled exceptions.

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120971

## From the sources

RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_