Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
Impact
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins (""), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Source excerpt · redhatA flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Red Hat · redhat
RESTEasy
2 ranges
Red Hat · redhat
RESTEasy
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 6.2.19.Final
maven versions
7.0.0.Alpha1 → before 7.0.5.Final
maven versions
Other versions: unaffected
Red Hat · redhat
Red Hat build of Quarkus 3.27.6.redhat
1 range
Red Hat · redhat
Red Hat build of Quarkus 3.27.6.redhat
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
6.2.19.Final-redhat-00003 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:quarkus:3.27::el8Red Hat · redhat
Red Hat build of Quarkus 3.33.4.redhat
1 range
Red Hat · redhat
Red Hat build of Quarkus 3.33.4.redhat
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
6.2.19.Final-redhat-00003 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:quarkus:3.33::el8Red Hat · redhat
Red Hat Enterprise Linux 10
1 range
Red Hat · redhat
Red Hat Enterprise Linux 10
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:11.9.0-6.el10_2.1 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:10.2Red Hat · redhat
Red Hat Enterprise Linux 9
1 range
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:3.0.26-20.el9_8.1 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:enterprise_linux:9::appstreamRed Hat · redhat
Red Hat build of Apache Camel 4 for Quarkus 3
0 ranges
Red Hat · redhat
Red Hat build of Apache Camel 4 for Quarkus 3
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:camel_quarkus:3Red Hat · redhat
Red Hat build of Apicurio Registry 3
0 ranges
Red Hat · redhat
Red Hat build of Apicurio Registry 3
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:apicurio_registry:3Red Hat · redhat
Red Hat build of Debezium 3
0 ranges
Red Hat · redhat
Red Hat build of Debezium 3
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:debezium:3Red Hat · redhat
Red Hat Build of Keycloak
0 ranges
Red Hat · redhat
Red Hat Build of Keycloak
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:build_keycloak:Red Hat · redhat
Red Hat Build of Keycloak
0 ranges
Red Hat · redhat
Red Hat Build of Keycloak
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:build_keycloak:Red Hat · redhat
Red Hat Certificate System 10
0 ranges
Red Hat · redhat
Red Hat Certificate System 10
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:certificate_system:10Red Hat · redhat
Red Hat Certificate System 11
0 ranges
Red Hat · redhat
Red Hat Certificate System 11
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:certificate_system:11Red Hat · redhat
Red Hat Enterprise Linux 8
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 8
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:8Red Hat · redhat
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Red Hat · redhat
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Red Hat · redhat
Red Hat Fuse 7
0 ranges
Red Hat · redhat
Red Hat Fuse 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_fuse:7Red Hat · redhat
Red Hat Fuse 7
0 ranges
Red Hat · redhat
Red Hat Fuse 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_fuse:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 8
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 8
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:8Red Hat · redhat
Red Hat JBoss Enterprise Application Platform Expansion Pack
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform Expansion Pack
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jbosseapxpRed Hat · redhat
Red Hat Satellite 6
0 ranges
Red Hat · redhat
Red Hat Satellite 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/a:redhat:satellite:6Red Hat · redhat
Red Hat Single Sign-On 7
0 ranges
Red Hat · redhat
Red Hat Single Sign-On 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:red_hat_single_sign_on:7Original source description
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-89058View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.