CVE catalog

CVE-2020-14326

resteasy3.0: CVE-2020-14326

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.25% · Oct 27, 2026

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianresteasy3.0sid3.0.26-6not affected
Debianresteasy3.0forky3.0.26-6not affected
Debianresteasy3.0trixie3.0.26-6not affected
Debianresteasy3.0bookworm3.0.26-6not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianresteasy3.0sourcesidNot affectedunimportantNot reportedNot reported
Debianresteasy3.0sourceforkyNot affectedunimportantNot reportedNot reported
Debianresteasy3.0sourcetrixieNot affectedunimportantNot reportedNot reported
Debianresteasy3.0sourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libresteasy3.0-java]Not affected

    Source package: [resteasy3.0]

    Details (2)

    • 3.0.26-6 · all · bookworm

      Not affected

      dsa · resteasy3.0 · debian · bookworm

    • 3.0.26-6 · all · bookworm

      Not affected

      dsa · resteasy3.0 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]