Bug#1153291: resteasy: CVE-2026-89058

[Moritz Mühlenhoff]

Source: resteasy
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for resteasy.

CVE-2026-89058[0]:
| A flaw was found in RESTEasy's CorsFilter, which, when configured to
| allow all origins ("*"), reflects the request's Origin header back
| in the Access-Control-Allow-Origin response together with Access-
| Control-Allow-Credentials: true. This permissive cross-origin policy
| allows a malicious website to make credentialed cross-origin
| requests and read authenticated responses from a victim's session,
| resulting in a loss of confidentiality.

https://bugzilla.redhat.com/show_bug.cgi?id=2519775
https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3
https://redhat.atlassian.net/browse/RESTEASY-3796

Fixed by: https://github.com/resteasy/resteasy/commit/b31525814f77a0619f612440ff27111174dbfef8 (v7.0.5.Final)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-89058
    https://www.cve.org/CVERecord?id=CVE-2026-89058

Please adjust the affected versions in the BTS as needed.