Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-p3uc-ee2b-fff5
Vulnerability ID VCID-p3uc-ee2b-fff5
Aliases CVE-2016-9606
GHSA-hgjr-xwj3-jfvw
Summary Improper Input Validation JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-20 Improper Input Validation
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 8.1 http://rhn.redhat.com/errata/RHSA-2017-1255.html
generic_textual HIGH http://rhn.redhat.com/errata/RHSA-2017-1255.html
cvssv3.1 8.1 http://rhn.redhat.com/errata/RHSA-2017-1409.html
generic_textual HIGH http://rhn.redhat.com/errata/RHSA-2017-1409.html
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1253
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1253
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1254
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1254
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1256
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1256
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1260
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1260
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1410
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1410
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1411
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1411
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1412
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1412
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1675
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1675
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2017:1676
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:1676
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2018:2909
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:2909
cvssv3.1 8.1 https://access.redhat.com/errata/RHSA-2018:2913
generic_textual HIGH https://access.redhat.com/errata/RHSA-2018:2913
cvssv3 8.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9606.json
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
epss 0.02263 https://api.first.org/data/v1/epss?cve=CVE-2016-9606
cvssv3.1 8.1 https://bugzilla.redhat.com/show_bug.cgi?id=1400644
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=1400644
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-hgjr-xwj3-jfvw
cvssv3.1 8.1 https://github.com/resteasy/Resteasy
generic_textual HIGH https://github.com/resteasy/Resteasy
cvssv3.1 8.1 https://nvd.nist.gov/vuln/detail/CVE-2016-9606
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2016-9606
cvssv3.1 8.1 http://www.securityfocus.com/bid/94940
generic_textual HIGH http://www.securityfocus.com/bid/94940
cvssv3.1 8.1 http://www.securitytracker.com/id/1038524
generic_textual HIGH http://www.securitytracker.com/id/1038524
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2017-1255.html
http://rhn.redhat.com/errata/RHSA-2017-1409.html
https://access.redhat.com/errata/RHSA-2017:1253
https://access.redhat.com/errata/RHSA-2017:1254
https://access.redhat.com/errata/RHSA-2017:1256
https://access.redhat.com/errata/RHSA-2017:1260
https://access.redhat.com/errata/RHSA-2017:1410
https://access.redhat.com/errata/RHSA-2017:1411
https://access.redhat.com/errata/RHSA-2017:1412
https://access.redhat.com/errata/RHSA-2017:1675
https://access.redhat.com/errata/RHSA-2017:1676
https://access.redhat.com/errata/RHSA-2018:2909
https://access.redhat.com/errata/RHSA-2018:2913
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9606.json
https://api.first.org/data/v1/epss?cve=CVE-2016-9606
https://bugzilla.redhat.com/show_bug.cgi?id=1400644
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9606
https://github.com/resteasy/Resteasy
http://www.securityfocus.com/bid/94940
http://www.securitytracker.com/id/1038524
851430 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851430
CVE-2016-9606 https://nvd.nist.gov/vuln/detail/CVE-2016-9606
GHSA-hgjr-xwj3-jfvw https://github.com/advisories/GHSA-hgjr-xwj3-jfvw
RHSA-2017:1255 https://access.redhat.com/errata/RHSA-2017:1255
RHSA-2017:1409 https://access.redhat.com/errata/RHSA-2017:1409
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://rhn.redhat.com/errata/RHSA-2017-1255.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://rhn.redhat.com/errata/RHSA-2017-1409.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1253
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1254
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1256
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1260
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1410
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1412
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1675
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:1676
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:2909
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2018:2913
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-9606.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1400644
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/resteasy/Resteasy
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2016-9606
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.securityfocus.com/bid/94940
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.securitytracker.com/id/1038524
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.84546
EPSS Score 0.02263
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:50:26.403995+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.jboss.resteasy/resteasy-bom/CVE-2016-9606.yml 38.0.0