Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | affected | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | affected | — |
| Red Hat | Red Hat build of Debezium 3 | affected | — |
| Red Hat | Red Hat Build of Keycloak | affected | — |
| Red Hat | Red Hat build of Quarkus | affected | — |
| Red Hat | Red Hat Fuse 7 | unknown | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | affected | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | affected | — |
| Red Hat | Red Hat Satellite 6 | affected | — |
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 03 Nov 2026 05:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed. | A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final. |
Tue, 03 Nov 2026 04:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed. | |
| Title | Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses | |
| First Time appeared |
Redhat
Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat debezium Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat jbosseapxp Redhat quarkus Redhat satellite |
|
| Weaknesses | CWE-209 | |
| CPEs | cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:debezium:3 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:quarkus:3 cpe:/a:redhat:satellite:6 |
|
| Vendors & Products |
Redhat
Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat debezium Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat jbosseapxp Redhat quarkus Redhat satellite |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-11-03T05:34:40.879Z
Reserved: 2026-11-03T04:01:17.695Z
Link: CVE-2026-120971
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-03T05:18:34.670
Modified: 2026-11-03T05:18:34.820
Link: CVE-2026-120971
Redhat
No data.
OpenCVE Enrichment
No data.