OESA-2026-4304

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4304
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-4304.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-4304
Upstream
Published
2026-10-16T11:59:09Z
Modified
2026-10-16T12:15:08Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
resteasy security update
Details

%global desc \ RESTEasy contains a JBoss project that provides frameworks to help\ build RESTful Web Services and RESTful Java applications. It is a fully\ certified and portable implementation of the JAX-RS specification. \ %global extdesc \ \ This package contains

Security Fix(es):

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality.(CVE-2026-89058)

Database specific 
{
    "severity":  "High"
}
References

Affected packages

openEuler:22.03-LTS-SP4 / resteasy

Package

Name
resteasy
Purl
pkg:rpm/openEuler/resteasy&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.0.19-6.oe2203sp4

Ecosystem specific 

{
    "noarch":  [
        "resteasy-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-atom-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-client-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-core-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-jackson-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-jackson2-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-javadoc-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-jaxb-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-jettison-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-json-p-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-multipart-provider-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-netty3-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-optional-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-test-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-validator-provider-11-3.0.19-6.oe2203sp4.noarch.rpm",
        "resteasy-yaml-provider-3.0.19-6.oe2203sp4.noarch.rpm"
    ],
    "src":  [
        "resteasy-3.0.19-6.oe2203sp4.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4304.json"