Read the docs
TI-2020-11197 Aliases CVE-2020-14326GHSA-37g7-8vjj-pjpj

Uncontrolled resource consumption in RESTEasy

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.

Why it matters now

EPSS 0.01246 69th percentileScored 2026-11-07
Fix Partial org.jboss.resteasy:resteasy-bom (Maven): 4.5.6.FinalRed Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—RESTEasyRESTEasy 4.5.6.Final—No fix listedCNA
—org.jboss.resteasy:resteasy-bom (Maven)before 4.5.6.Final4.5.6.FinalPatch availableGHSA-37g7-8vjj-pjpj
  • RESTEasy Vendor— Affected RESTEasy 4.5.6.Final Fixed in — No fix listed CNA
  • org.jboss.resteasy:resteasy-bom (Maven) Vendor— Affected before 4.5.6.Final Fixed in 4.5.6.Final Patch available GHSA-37g7-8vjj-pjpj

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*4.2.0 to before 4.5.6VulnerableRed Hat
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.5.6 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-37g7-8vjj-pjpj org.jboss.resteasy:resteasy-bom (Maven) Fixed in 4.5.6.Final Advisory →

Red Hat 4 advisories

  • RHSA-2021:4918 Released 2021-12-02 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.6 release and security update
    • Red Hat Integration
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2020:5568 Released 2020-12-16 · Red Hat rating Important
    Red Hat Fuse 7.8.0 release and security update
    • Red Hat Fuse 7.8.0
Show 1 more Red Hat advisories
  • RHSA-2020:3248 Released 2020-07-30 · Red Hat rating Important
    Red Hat build of Quarkus 1.3.4 SP1 release and security update
    • Red Hat build of Quarkus 1.3.4 SP1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Fuse 7.8.0Fixed RHSA-2020:5568
Red Hat IntegrationFixed RHSA-2021:4918
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat build of Quarkus 1.3.4 SP1Fixed RHSA-2020:3248
Not affected: 5 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14326
  2. 2026-10-03 Alias added: GHSA-37g7-8vjj-pjpj

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences