// For flags

CVE-2020-14326

RESTEasy: Caching routes in RootNode may result in DoS

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.

Se encontrado una vulnerabilidad en RESTEasy, donde RootNode almacena incorrectamente las rutas en caché. Este problema resulta en una inundación de hash, lo que conlleva a una ralentización de las peticiones con un mayor tiempo de CPU dedicado a buscar y añadir la entrada. Este fallo permite a un atacante causar una denegación de servicio

This release of Red Hat Fuse 7.8.0 serves as a replacement for Red Hat Fuse 7.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include XML injection, bypass, code execution, cross site scripting, denial of service, deserialization, file disclosure, information leakage, memory leak, out of bounds read, privilege escalation, server-side request forgery, and remote SQL injection vulnerabilities.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-06-17 CVE Reserved
  • 2020-07-30 CVE Published
  • 2024-08-04 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-407: Inefficient Algorithmic Complexity
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Integration Camel K
Search vendor "Redhat" for product "Integration Camel K"
--
Affected
Redhat
Search vendor "Redhat"
 Resteasy
Search vendor "Redhat" for product "Resteasy"
 >= 4.2.0 < 4.5.6
Search vendor "Redhat" for product "Resteasy" and version " >= 4.2.0 < 4.5.6"
-
Affected
Netapp
Search vendor "Netapp"
 Oncommand Insight
Search vendor "Netapp" for product "Oncommand Insight"
--
Affected