CVE-2026-120971 in Apache Camel
Summary
by MITRE • 11/03/2026
RESTEasy's default exception mapper returns an exception's localized message in the HTTP 500 response body when no application exception mapper handles an unhandled exception other than a WebApplicationException. A remote unauthenticated client who can trigger such an exception may receive information included in the message. Fabio Burzigotti reports reproducing the behavior with RESTEasy 7.0.2.Final. The complete affected and fixed version ranges remain to be confirmed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in RESTEasy, specifically within versions leading up to and including 7.0.2.Final, represents a significant information disclosure flaw rooted in the framework's default exception handling mechanism. RESTEasy is a widely adopted implementation of Java EE JAX-RS that facilitates the creation of RESTful web services using Java. A critical component of any robust web application framework is its ability to handle unexpected errors gracefully without exposing sensitive internal details to external clients. In this scenario, when an unhandled exception occurs within a RESTEasy service and no custom application-level exception mapper has been configured to intercept it, the framework falls back to a default exception mapper. This default handler constructs an HTTP 500 Internal Server Error response but inadvertently includes the localized message associated with the thrown exception directly in the response body.
This behavior creates a direct pathway for information leakage because Java exceptions often contain stack traces, class names, file paths, database query details, or other contextual data that can be highly valuable to an attacker. A remote unauthenticated client who is capable of triggering such an unhandled exception can exploit this default mapping to extract these internal details. For instance, if a developer has left debug logging enabled in the production environment or if the application logic inadvertently throws exceptions with verbose messages containing sensitive configuration data, that information becomes accessible via standard HTTP responses. The attacker does not need authentication privileges; they only need to identify an endpoint susceptible to triggering an unhandled exception and then observe the resulting error response body for leaked intelligence.
From a technical perspective, this flaw aligns with CWE-209: Generation of Error Message Containing Sensitive Information. It also maps closely to ATT&CK technique T1583.007: Acquire Infrastructure: Virtual Private Server or Cloud Instances if the disclosed information aids in further reconnaissance, but more directly it falls under initial access and discovery phases where leaked stack traces can reveal technology stacks (CWE-200) allowing for targeted follow-up attacks such as injection or deserialization exploits based on known vulnerabilities of exposed libraries. The root cause lies in the design choice to prioritize developer convenience during debugging over security hardening by default, exposing internal state through standard error channels that are often logged and monitored by attackers using automated scanning tools.
The operational impact of this vulnerability is substantial for organizations relying on RESTEasy for their API infrastructure. Beyond the immediate risk of data exposure, it facilitates further exploitation by providing attackers with precise knowledge of the underlying technology stack, version numbers, and internal architecture. This intelligence reduces the effort required to craft subsequent attacks, such as SQL injection or remote code execution attempts tailored to specific library versions identified in the error messages. Furthermore, because this occurs on unhandled exceptions, any endpoint that fails due to a bug, misconfiguration, or malicious input can serve as an information leak vector, effectively turning every potential point of failure into a reconnaissance tool for adversaries.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most effective solution is to implement custom exception mappers in the application code that override the default behavior. These custom handlers should sanitize error responses by returning generic HTTP 500 messages without exposing stack traces or internal variable values, while logging detailed errors securely on the server side for developer review only. Additionally, developers must ensure that production environments do not have debug modes enabled and that exception messages are carefully crafted to avoid leaking sensitive context. Upgrading RESTEasy to a version where this default behavior is corrected or strictly controlled by configuration flags is also essential once fixed versions are officially confirmed. Regular security testing using static analysis tools can help identify places in the codebase where exceptions might be thrown without proper handling, ensuring that no unhandled paths remain open for exploitation.