CVE-2021-20289

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-26 · updated 2026-06-17
Weakness: CWE-209

Description

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.

Affected products

OnCommand Insight: all versions
Oracle Communications Cloud Native Core Console: 1.9.0
quarkusio quarkus: before 1.13.4 — fixed in 1.13.4
Red Hat, Inc. resteasy: through 4.6.0

How to fix

Upgrade to a fixed version: quarkusio quarkus 1.13.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20289 or the next vulnerability affects your stack