CVE-2026-89058highCWE-346CWE-942

CVE-2026-89058: falha de alta gravidade em Red Hat RESTEasy

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Enterprise Linux+ Monitorar Red Hat build of Keycloak

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.4epss 0.5%
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
Red Hat · Red Hat Build of Apache Camel 3.33.4.redhatRed Hat · Red Hat build of Apache Camel 4 for Quarkus 3Red Hat · Red Hat build of Apicurio Registry 3Red Hat · Red Hat build of Debezium 3Red Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of Quarkus 3.27.6.redhatRed Hat · Red Hat build of Quarkus 3.33.4.redhatRed Hat · Red Hat Certificate System 10Red Hat · Red Hat Certificate System 11Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat · Red Hat Fuse 7Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8.1Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Satellite 6Red Hat · Red Hat Single Sign-On 7Red Hat · RESTEasy
CVEs relacionadas — Red Hat RESTEasy

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.6%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.2%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 1.5%