What’s Vulnerable › Vulnerabilities

CVE-2020-25724

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-26 · updated 2026-06-17
• Weakness: CWE-567

Description

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.

Affected products

• quarkusio quarkus: before 1.11.2 — fixed in 1.11.2
• Red Hat, Inc. resteasy: before 2.0.0; 2.0.0-alpha1, 2.0.0-alpha2 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: quarkusio quarkus 1.11.2; Red Hat, Inc. resteasy 2.0.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1899354
• https://security.netapp.com/advisory/ntap-20210702-0003/
• https://bugzilla.redhat.com/show_bug.cgi?id=1899354
• https://security.netapp.com/advisory/ntap-20210702-0003/

Get alerted when CVE-2020-25724 or the next vulnerability affects your stack