WaratekVRT Sign in

High Resteasy CVEs

8 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Product resteasy✕
Overview 8 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
8matches 2protected25.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 75.0%
Critical 0 0.0% High 8 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 25.0% partly blocked 0 0.0% not blocked 6 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 8 100.0%
split by peak 2 / year
No exploit published: 6Protected by Waratek: 2 High: 8 not blocked: 6blocked by ARMR today: 2 No public exploit: 8
20141 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20150 20161 No exploit published1 High1 not blocked1 No public exploit1 20171 No exploit published1 High1 not blocked1 No public exploit1 20182 Protected by Waratek1 No exploit published1 High2 blocked by ARMR today1 not blocked1 No public exploit2 20190 20201 No exploit published1 High1 not blocked1 No public exploit1 20211 No exploit published1 High1 not blocked1 No public exploit1 20220 20230 20240 20251 No exploit published1 High1 not blocked1 No public exploit1
201420152016201720182019202020212022202320242025
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-1634 High 2025-02-26 No exploit published No public exploit A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
CVE-2020-14326 High 2021-06-02 No exploit published No public exploit A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.
CVE-2020-1695 High 2020-05-19 No exploit published No public exploit A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
CVE-2016-9606 High 2018-03-09 No exploit published No public exploit JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.
CVE-2018-1051 High 2018-01-25 Protected by Waratek No public exploit It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.
CVE-2017-7561 High 2017-09-13 No exploit published No public exploit Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.
CVE-2016-6346 High 2016-09-07 No exploit published No public exploit RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.
CVE-2014-3490 High 2014-08-19 Protected by Waratek No public exploit RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.