Unsynchronized Access to Shared Data in a Multithreaded Context in RESTEasy

MEDIUM 4.3CVE-2020-25724 · GHSA-9699-gm7f-cmjv · Published 26/05/2021 · updated 17/06/2026

In short

CVE-2020-25724 is a MEDIUM (CVSS 4.3) vulnerability affecting org.jboss.resteasy:resteasy-bom, quarkus (quarkus), resteasy (redhat).
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.2% of all vulnerabilities.
Fix: update to 2.0-beta-2, 1.11.2, 2.0.0 or later.

Package	Affected versions	Patched versions
org.jboss.resteasy:resteasy-bom Maven	`< 2.0-beta-2`	`2.0-beta-2`
quarkus quarkus	`< 1.11.2`	`1.11.2`
resteasy redhat	`= 2.0.0< 2.0.0`	`2.0.0`

Description

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-25724 · ADVISORY
access.redhat.com/security/cve/cve-2020-25724 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
security.netapp.com/advisory/ntap-20210702-0003 · WEB
security.netapp.com/advisory/ntap-20210702-0003 · Third Party Advisory

More vulnerabilities in org.jboss.resteasy:resteasy-bom

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jboss.resteasy:resteasy-bom

Maven

< 2.0-beta-2

2.0-beta-2

quarkus

< 1.11.2

1.11.2

resteasy

redhat

= 2.0.0< 2.0.0

2.0.0

Description

NVD description

More vulnerabilities in org.jboss.resteasy:resteasy-bom

See all →