CVE-2026-120971
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105770 Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to… CWE-209
- CVE-2026-62979 jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. CWE-209
- CVE-2026-118643 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential… CWE-209
- CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper… CWE-209
- CVE-2026-118272 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. CWE-209
- CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server. CWE-209
- CVE-2026-116478 A vulnerability was detected in a2aproject a2a-go up to 2.4.0. CWE-209
- CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. CWE-209