CVE-2026-120971
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed.