A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided.
Priority LOW 21CWE-567Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Why it matters now
EPSS 0.00629 50th percentileScored 2026-11-07
Fix Fixed org.jboss.resteasy:resteasy-bom (Maven): 2.0-beta-2Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | resteasy | resteasy 2.0.0.Alpha3 | — | No fix listed | CNA |
| — | org.jboss.resteasy:resteasy-bom (Maven) | before 2.0-beta-2 | 2.0-beta-2 | Patch available | GHSA-9699-gm7f-cmjv |
- resteasy Vendor— Affected resteasy 2.0.0.Alpha3 Fixed in — No fix listed CNA
- org.jboss.resteasy:resteasy-bom (Maven) Vendor— Affected before 2.0-beta-2 Fixed in 2.0-beta-2 Patch available GHSA-9699-gm7f-cmjv
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* | before 2.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:resteasy:2.0.0:alpha1:*:*:*:*:*:* | 2.0.0 alpha1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:resteasy:2.0.0:alpha2:*:*:*:*:*:* | 2.0.0 alpha2 | Vulnerable | Red Hat |
| cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* | before 1.11.2 | Vulnerable | quarkusio |
- cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:resteasy:2.0.0:alpha1:*:*:*:*:*:* Versions 2.0.0 alpha1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:resteasy:2.0.0:alpha2:*:*:*:*:*:* Versions 2.0.0 alpha2 Vulnerable ·Red Hat
- cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 1.11.2 Vulnerable ·quarkusio
Remediation
- Fix · GHSA-9699-gm7f-cmjv org.jboss.resteasy:resteasy-bom (Maven) Fixed in 2.0-beta-2 Advisory →
Red Hat 1 advisory
- RHSA-2021:1004 Released 2021-03-29 · Red Hat rating ModerateRed Hat build of Quarkus 1.11.6 release and security update
- Text-Only RHOAR
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Text-Only RHOAR | Fixed | RHSA-2021:1004 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25724
- 2026-10-03 Alias added: GHSA-9699-gm7f-cmjv
- 2026-10-29 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2020-25724 · CVE Program
- CVE-2020-25724 · NVD
- FIRST EPSS
- GHSA-9699-gm7f-cmjv · GitHub Advisory Database · CC BY 4.0
- CVE-2020-25724 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences