CVE-2016-9606: Red Hat Resteasy

High severity, CVSS 8.1. EPSS: 6% chance of exploitation in the next 30 days.

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.

Affected products

• Red Hat Resteasy: up to and including 3.1.1

Published 2018-03-09. Last modified 2026-06-17.