CVE-2026-120971
Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
Description
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
CWE
Affected
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat Red Hat build of Apicurio Registry 3; Red Hat Red Hat build of Debezium 3; Red Hat Red Hat Build of Keycloak; Red Hat Red Hat build of Quarkus; Red Hat Red Hat Fuse 7; Red Hat Red Hat JBoss Enterprise Application Platform 8; Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Red Hat Satellite 6