CVE-2026-120971

{
  "id": "CVE-2026-120971",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T05:18:34.670",
  "lastModified": "2026-11-03T05:18:34.820",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:camel_quarkus:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Apicurio Registry 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:apicurio_registry:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Debezium 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:debezium:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat build of Quarkus",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:quarkus:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Fuse 7",
          "defaultStatus": "unknown",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:jboss_fuse:7"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform 8",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:jboss_enterprise_application_platform:8"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "packageName": "resteasy-core",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Satellite 6",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "candlepin",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-120971",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565584",
      "source": "[email protected]"
    }
  ]
}