UBUNTU-CVE-2026-120971: Medium severity ubuntu/resteasy vulnerability
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using RESTEasy are exposed when an unhandled exception other than a WebApplicationException can be triggered and the application does not provide an exception mapper that handles it. The issue was reproduced with RESTEasy 7.0.2.Final.
Does exploitation require authentication or user interaction?
No. The reported attack vector is network-accessible with low attack complexity, no privileges required, and no user interaction.
What can be done if an update cannot be applied immediately?
Ensure the application has exception mappers that handle relevant unhandled exceptions and do not include localized exception messages in HTTP 500 response bodies.
How can I check whether an application is affected?
Trigger a controlled unhandled exception other than a WebApplicationException and inspect the resulting HTTP 500 response. An affected application may return the exception's localized message in the response body.