Read the docs
TI-2016-05434 Aliases CVE-2016-6346GHSA-wxvr-vqfp-9cqw

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.

Priority MEDIUM 41Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 12 fixed, 13 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.

Why it matters now

EPSS 0.05601 92nd percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-jaxrs (Maven): 3.0.20.FinalRed Hat: 13 advisoriesRed Hat: 12 fixed, 13 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.jboss.resteasy:resteasy-jaxrs (Maven)before 3.0.20.Final3.0.20.FinalPatch availableGHSA-wxvr-vqfp-9cqw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-jaxrs (Maven) Vendor— Affected before 3.0.20.Final Fixed in 3.0.20.Final Patch available GHSA-wxvr-vqfp-9cqw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:resteasy:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:resteasy:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-wxvr-vqfp-9cqw org.jboss.resteasy:resteasy-jaxrs (Maven) Fixed in 3.0.20.Final Advisory →

Red Hat 13 advisories

  • RHSA-2019:1222 Released 2019-05-14 · Red Hat rating Moderate
    Satellite 6.5 Release
    • Red Hat Satellite 6.5 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.6-1.el7sat, candlepin-2.5.15-1.el7sat +47
    • Red Hat Satellite Capsule 6.5 SOAPpy-0.11.6-17.el7, ansiblerole-insights-client-1.6-1.el7sat, createrepo_c-0.7.4-1.el7sat +47
  • RHSA-2018:2143 Released 2018-07-05 · Red Hat rating Important
    Red Hat Decision Manager 7.0.1 bug fix and security update
    • Red Hat JBoss BRMS 7.0
  • RHSA-2018:0005 Released 2018-01-03 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el7
Show 10 more Red Hat advisories
  • RHSA-2018:0004 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el7 +47
  • RHSA-2018:0002 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el6 +47
  • RHSA-2018:0003 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:1675 Released 2017-07-04 · Red Hat rating Moderate
    Red Hat JBoss BPM Suite security update
    • Red Hat JBoss BPMS 6.4
  • RHSA-2017:1676 Released 2017-07-04 · Red Hat rating Moderate
    Red Hat JBoss BRMS security update
    • Red Hat JBoss BRMS 6.4
  • RHSA-2017:0829 Released 2017-03-22 · Red Hat rating Important
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.14-2.Final_redhat_2.ep6.el6, jboss-ec2-eap-samples-7.5.14-2.Final_redhat_2.ep6.el6
  • RHSA-2017:0826 Released 2017-03-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server apache-cxf-2.7.18-6.SP5_redhat_1.1.ep6.el5, hornetq-2.3.25-19.SP17_redhat_1.1.ep6.el5, infinispan-5.2.21-1.Final_redhat_1.1.ep6.el5 +47
  • RHSA-2017:0827 Released 2017-03-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-6.SP5_redhat_1.1.ep6.el6, hornetq-2.3.25-19.SP17_redhat_1.1.ep6.el6, infinispan-5.2.21-1.Final_redhat_1.1.ep6.el6 +47
  • RHSA-2017:0828 Released 2017-03-22 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 6.4.14 update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server apache-cxf-2.7.18-6.SP5_redhat_1.1.ep6.el7, hornetq-2.3.25-19.SP17_redhat_1.1.ep6.el7, infinispan-5.2.21-1.Final_redhat_1.1.ep6.el7 +47
  • RHSA-2017:0517 Released 2017-03-14 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Virtualization 3Affected—
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss BRMS 6AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat JBoss Operations Network 3AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffected—
Red Hat JBoss BPMS 6.4Fixed RHSA-2017:1675
Red Hat JBoss BRMS 6.4Fixed RHSA-2017:1676
Red Hat JBoss BRMS 7.0Fixed RHSA-2018:2143
Red Hat JBoss EAP 7.0Fixed RHSA-2018:0003
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2017:0517
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2017:0826
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2017:0827, RHSA-2017:0829
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2017:0828
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2018:0002, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2018:0004, RHSA-2018:0005
Red Hat Satellite 6.5Fixed RHSA-2019:1222
Red Hat Satellite Capsule 6.5Fixed RHSA-2019:1222
Not affected: 5 products
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Portal 6
  • Red Hat OpenShift Application Runtimes
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6346
  2. 2026-10-03 Alias added: GHSA-wxvr-vqfp-9cqw
  3. 2026-11-05 Fix available: Red Hat JBoss EAP 7.0 · Red Hat

References

Advisory 14

Other 4

  • TI-2016-07827 Improper input validation in Red Hat RESTEasy CVSS 3.0HIGH 8.1
  • TI-2014-02817 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise… CVSS 2.0HIGH 7.5
  • TI-2018-00972 Improper input validation in Red Hat resteasy CVSS 3.0HIGH 8.1
  • TI-2020-01642 Improper input validation in Red Hat resteasy CVSS 3.1HIGH 7.5
  • TI-2020-11197 Uncontrolled resource consumption in RESTEasy CVSS 3.1HIGH 7.5
  • TI-2016-05433 RESTEasy allows remote authenticated users to obtain sensitive information by leveraging… CVSS 3.0MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences