{"id":"CVE-2016-9606","details":"JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.","aliases":["GHSA-hgjr-xwj3-jfvw"],"modified":"2026-04-11T16:44:04.793622Z","published":"2018-03-09T20:29:00.503Z","references":[{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-1255.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2017-1409.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/94940"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1038524"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1253"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1254"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1256"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1260"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1410"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1411"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1412"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1675"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1676"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2909"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2913"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1400644"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/resteasy/resteasy","events":[{"introduced":"0"},{"last_affected":"0161e4e0e614bd6b3d2c35e512e022e1bb7066dd"}],"database_specific":{"source":"CPE_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"3.1.1"}],"cpe":"cpe:2.3:a:redhat:resteasy:*:*:*:*:*:*:*:*"}}],"versions":["3.0-beta-1","3.0-beta-2","3.0-beta-3","3.0-beta-4","3.0-beta-5","3.0-beta-6","3.0-rc-1","3.0.0.Final","3.0.1.Final","3.0.10.Final","3.0.13.Final","3.0.14.Final","3.0.15.Final","3.0.16.Final","3.0.2","3.0.4","3.0.5.Final","3.0.6.Final","3.0.7.Final","3.0.8.Final","3.0.9.Final","3.1.0.Beta1","3.1.0.Beta2","3.1.0.CR1","3.1.0.CR2","3.1.0.CR3","3.1.0.Final","3.1.1.Final"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9606.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}