CVE-2026-120971: Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
Vulnerability summary
CVE-2026-120971 is a medium (CVSS 5.3) vulnerability in resteasy Ubuntu. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 28% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 03-11-2026PublishedVulnerability first disclosed.
- 03-11-2026Last modifiedVulnerability information updated.
Description
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu2 products
- resteasyAll versions (No fix recorded)
- resteasy3.0All versions (No fix recorded)
1 vendor · 2 products