RESTEasy CVE-2026-120971

Exploitation requires that the target RESTEasy application throws an unhandled exception that is NOT a WebApplicationException AND has no application-level ExceptionMapper registered for it, so RESTEasy's default exception mapper handles it and places the exception's localized message into the HTTP 500 response body. This is the default behavior, so no non-default configuration is needed, and the vector is remote and unauthenticated (PR:N). The practical limiting factors are: (1) the attacker must be able to induce such an exception, (2) applications that register their own exception mappers are not affected, and (3) the confidentiality impact is bounded by whatever content the exception's localized message actually contains - the flaw discloses message text, not arbitrary memory or files, so real-world impact varies by how much sensitive data those messages carry.

This is a moderate-severity information disclosure flaw (CWE-209) whose signals are internally consistent but point to limited, opportunistic rather than urgent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) indicates a remote, low-complexity, unauthenticated issue with only low confidentiality impact and no integrity or availability effect, which matches the description: RESTEasy's default exception mapper echoes an unhandled exception's localized message into the HTTP 500 body. No EPSS score was provided in the input, the vulnerability is NOT listed in CISA KEV, and the two references are a Red Hat advisory and a Bugzilla entry rather than exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-non-critical priority. The key caveat is that actual impact is conditional and data-dependent: the severity of what leaks depends entirely on whether triggerable exception messages contain sensitive content (stack-trace-adjacent detail, internal identifiers, SQL fragments, paths), and the description does not confirm that sensitive data is reliably exposed. Treat this as a defense-in-depth hardening item to remediate on a normal patch cycle, not a drop-everything emergency.

A remote unauthenticated client sends requests crafted to trigger an application error - malformed input, unexpected parameters, or a backend fault - that surfaces as an unhandled exception other than a WebApplicationException in a RESTEasy-based service that has not registered a custom exception mapper. RESTEasy's default mapper returns the exception's localized message in the HTTP 500 response body, and the attacker reads that body to harvest internal details. No public exploit code is identified; Fabio Burzigotti reported reproducing the behavior with RESTEasy 7.0.2.Final.