Read the docs
TI-2016-07827 Aliases CVE-2016-9606GHSA-hgjr-xwj3-jfvw

Improper input validation in Red Hat RESTEasy

Priority MEDIUM 44CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

Why it matters now

EPSS 0.0597 93rd percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-bom (Maven): 3.1.2.FinalRed Hat: 13 advisoriesRed Hat: 11 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRESTEasy3.1.2—No fix listedCNA
—org.jboss.resteasy:resteasy-bom (Maven)before 3.1.2.Final3.1.2.FinalPatch availableGHSA-hgjr-xwj3-jfvw
  • RESTEasy VendorRed Hat Affected 3.1.2 Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-bom (Maven) Vendor— Affected before 3.1.2.Final Fixed in 3.1.2.Final Patch available GHSA-hgjr-xwj3-jfvw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*up to 3.1.1VulnerableRed Hat
  • cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions up to 3.1.1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-hgjr-xwj3-jfvw org.jboss.resteasy:resteasy-bom (Maven) Fixed in 3.1.2.Final Advisory →

Red Hat 13 advisories

  • RHSA-2018:2913 Released 2018-10-11 · Red Hat rating Moderate
    Red Hat Decision Manager 7.1.0 bug fix and security update
    • Red Hat JBoss BRMS 7.1
  • RHSA-2018:2909 Released 2018-10-11 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.1.0 bug fix and security update
    • Red Hat JBoss BPMS 7.1
  • RHSA-2017:1675 Released 2017-07-04 · Red Hat rating Moderate
    Red Hat JBoss BPM Suite security update
    • Red Hat JBoss BPMS 6.4
Show 10 more Red Hat advisories
  • RHSA-2017:1676 Released 2017-07-04 · Red Hat rating Moderate
    Red Hat JBoss BRMS security update
    • Red Hat JBoss BRMS 6.4
  • RHSA-2017:1412 Released 2017-06-07 · Red Hat rating Moderate
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.6-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.6-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.6-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.6-1.GA_redhat_1.ep7.el7
  • RHSA-2017:1410 Released 2017-06-07 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-17.SP20_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-17.SP20_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-17.SP20_redhat_1.1.ep7.el6 +47
  • RHSA-2017:1411 Released 2017-06-07 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-17.SP20_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-17.SP20_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-17.SP20_redhat_1.1.ep7.el7 +47
  • RHSA-2017:1409 Released 2017-06-07 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:1260 Released 2017-05-18 · Red Hat rating Moderate
    jboss-ec2-eap security, bug fix, and enhancement update
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server jboss-ec2-eap-7.5.15-3.Final_redhat_3.ep6.el6, jboss-ec2-eap-samples-7.5.15-3.Final_redhat_3.ep6.el6
  • RHSA-2017:1255 Released 2017-05-18 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 6.4
  • RHSA-2017:1256 Released 2017-05-18 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.15 update on RHEL 5
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server hibernate4-core-eap6-4.2.26-1.Final_redhat_1.1.ep6.el5, hibernate4-eap6-4.2.26-1.Final_redhat_1.1.ep6.el5, hibernate4-entitymanager-eap6-4.2.26-1.Final_redhat_1.1.ep6.el5 +47
  • RHSA-2017:1253 Released 2017-05-18 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.15 update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hibernate4-core-eap6-4.2.26-1.Final_redhat_1.1.ep6.el7, hibernate4-eap6-4.2.26-1.Final_redhat_1.1.ep6.el7, hibernate4-entitymanager-eap6-4.2.26-1.Final_redhat_1.1.ep6.el7 +47
  • RHSA-2017:1254 Released 2017-05-18 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.4.15 update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server hibernate4-core-eap6-4.2.26-1.Final_redhat_1.1.ep6.el6, hibernate4-eap6-4.2.26-1.Final_redhat_1.1.ep6.el6, hibernate4-entitymanager-eap6-4.2.26-1.Final_redhat_1.1.ep6.el6 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix yet
Red Hat JBoss BRMS 6AffectedNo fix yet
Red Hat JBoss BPMS 6.4Fixed RHSA-2017:1675
Red Hat JBoss BPMS 7.1Fixed RHSA-2018:2909
Red Hat JBoss BRMS 6.4Fixed RHSA-2017:1676
Red Hat JBoss BRMS 7.1Fixed RHSA-2018:2913
Red Hat JBoss EAP 7.0Fixed RHSA-2017:1409
Red Hat JBoss Enterprise Application Platform 6.4Fixed RHSA-2017:1255
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 ServerFixed RHSA-2017:1256
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 ServerFixed RHSA-2017:1254, RHSA-2017:1260
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 ServerFixed RHSA-2017:1253
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:1410, RHSA-2017:1412
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:1411, RHSA-2017:1412
Not affected: 6 products
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Operations Network 3
  • Red Hat JBoss Portal 6
  • Red Hat Mobile Application Platform 4
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9606
  2. 2026-10-03 Alias added: GHSA-hgjr-xwj3-jfvw
  3. 2026-11-05 Fix available: Red Hat JBoss EAP 7.0 · Red Hat

References

Advisory 15

Other 1

  • TI-2016-05434 RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. CVSS 3.0HIGH 7.5
  • TI-2014-02817 RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise… CVSS 2.0HIGH 7.5
  • TI-2018-00972 Improper input validation in Red Hat resteasy CVSS 3.0HIGH 8.1
  • TI-2020-01642 Improper input validation in Red Hat resteasy CVSS 3.1HIGH 7.5
  • TI-2020-11197 Uncontrolled resource consumption in RESTEasy CVSS 3.1HIGH 7.5
  • TI-2016-05433 RESTEasy allows remote authenticated users to obtain sensitive information by leveraging… CVSS 3.0MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences