Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Resteasy: Unvalidated Input Can Inject into HTTP Response

CVE-2020-1695 · published 6 years ago
Summary

All versions of Resteasy before 3.12.0.Final and 4.6.0.Final are affected. An attacker could inject malicious data into the HTTP response, potentially causing unexpected behavior. Update to a fixed version of Resteasy to prevent this risk.

What to do
  • Update jboss org.jboss.resteasy:resteasy-client to version 4.6.0.
  • Update jboss org.jboss.resteasy:resteasy-client to version 3.12.0.
  • Update canonical resteasy to version 3.0.6-3ubuntu0.1~esm1.
  • Update canonical resteasy3.0 to version 3.0.26-1~18.04.1~esm1.
  • Update canonical resteasy to version 3.6.2-2ubuntu0.20.04.1~esm1.
  • Update canonical resteasy3.0 to version 3.0.26-1ubuntu0.1~esm1.
  • Update canonical resteasy to version 3.6.2-2ubuntu0.22.04.1~esm1.
  • Update canonical resteasy to version 3.6.2-2ubuntu0.24.04.1~esm1.
  • Update debian resteasy3.0 to version 3.0.26-2.
Affected software
Ecosystem VendorProductAffected versions
maven jboss org.jboss.resteasy:resteasy-client >= 4.0.0, <= 4.5.12
>= 3.0.0, <= 3.11.5
Fix: upgrade to 4.6.0
– redhat resteasy >= 3.0.0, < 3.12.0
>= 4.0.0, < 4.6.0
cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*
– fedoraproject fedora 32
33
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Ubuntu:Pro:16.04:LTS canonical resteasy < 3.0.6-3ubuntu0.1~esm1
Fix: upgrade to 3.0.6-3ubuntu0.1~esm1
Ubuntu:Pro:18.04:LTS canonical resteasy3.0 < 3.0.26-1~18.04.1~esm1
Fix: upgrade to 3.0.26-1~18.04.1~esm1
Ubuntu:Pro:20.04:LTS canonical resteasy < 3.6.2-2ubuntu0.20.04.1~esm1
Fix: upgrade to 3.6.2-2ubuntu0.20.04.1~esm1
Ubuntu:Pro:20.04:LTS canonical resteasy3.0 < 3.0.26-1ubuntu0.1~esm1
Fix: upgrade to 3.0.26-1ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS canonical resteasy < 3.6.2-2ubuntu0.22.04.1~esm1
Fix: upgrade to 3.6.2-2ubuntu0.22.04.1~esm1
Ubuntu:Pro:24.04:LTS canonical resteasy < 3.6.2-2ubuntu0.24.04.1~esm1
Fix: upgrade to 3.6.2-2ubuntu0.24.04.1~esm1
Ubuntu:25.10 canonical resteasy All versions
Debian:12 debian resteasy3.0 < 3.0.26-2
Fix: upgrade to 3.0.26-2
Original advisory text
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header...
A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published19 May 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-63cq-ppq8-cw6g · GHSA
CVE-2020-1695 · NVD
UBUNTU-CVE-2020-1695 · OSV
CVE-2020-1695 · OSV
DEBIAN-CVE-2020-1695 · OSV
Track software like this
Free during beta