Loading story…
Red Hat addressed CVE-2014-3490, a moderate-severity XML external entity (XXE) vulnerability in RESTEasy caused by an incomplete correction for CVE-2012-0818. Even when resteasy.document.expand.entity.references was set to false, RESTEasy continued to permit external parameter entities. An unauthenticated remote attacker able to submit XML to a vulnerable RESTEasy endpoint could read files accessible to the application-server account, make server-side HTTP requests that bypass network restrictions, or consume resources for denial of service.
Fixes were released for affected RESTEasy packages in Red Hat Enterprise Linux and multiple JBoss products, with upstream patches merged into RESTEasy 2.3 and master branches. Red Hat also included the remediation in the Important-rated RHSA-2015:0720 rollup for JBoss Fuse Service Works 6.0.0; organizations should apply the applicable vendor updates and ensure XML parsers and validators disable external entity expansion, including DTD external parameter entities.
See affected versions and whether adversaries are exploiting it.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Important-rated RHSA-2015:0720 and rollup patch 4 for JBoss Fuse Service Works 6.0.0. The cumulative update fixed CVE-2014-3490 along with 17 other security vulnerabilities across bundled components.
Red Hat released Moderate-rated RHSA-2015:0217 for JBoss EAP 6.3.3 on RHEL 6, replacing EAP 6.3.2. The update fixed CVE-2014-7839, an RESTEasy DocumentProvider XXE issue that could allow remote file disclosure, along with four other EAP vulnerabilities.
Red Hat released RHSA-2014:1011 for the resteasy-base component in Red Hat Enterprise Linux 7, remediating CVE-2014-3490, an XXE flaw allowing external parameter entities despite a disabled entity-reference setting.
Fedora 20's stable repository received resteasy-3.0.6-3.fc20, a package fixing the CVE-2014-3490 RESTEasy XXE vulnerability.
RHSA-2015:0765 remediated CVE-2014-3490 in the RESTEasy component included with JBoss Data Virtualization 6.0.
RHSA-2015:0675 fixed CVE-2014-3490 in the RESTEasy component shipped with JBoss Data Virtualization 6.1.
Red Hat issued RHSA-2015:0234 for JBoss BPMS 6.0 and RHSA-2015:0235 for JBoss BRMS 6.0 to address CVE-2014-3490 in RESTEasy.
RESTEasy merged pull request #611 (commit 7a0b80f) into its Branch_2_3 branch for RESTEASY-1130, adding configuration for expansion of external general and parameter entities and tests including one for Red Hat Xerces.
RHSA-2014:1298 remediated CVE-2014-3490 in JBoss Data Grid 6.3, which bundled the affected RESTEasy component.
Red Hat issued RHSA-2014:1039 and RHSA-2014:1040 to fix the RESTEasy XXE vulnerability in JBoss Enterprise Application Platform 6.3, including builds for RHEL 5, RHEL 6, and RHEL 7.
Upstream RESTEasy applied pull requests 533 for the 2.3 branch and 521 for the master branch, including commit 9b7d0f574cafdcf3bea5428f3145ab4908fc6d83, to address CVE-2014-3490; RESTEASY-1073 was closed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourcegithub.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released moderate-severity updates for **JBoss Enterprise Application Platform (EAP) 6.3.3/6.3.z** on Red Hat Enterprise Linux 5, 6, and 7, addressing five flaws in RESTEasy XML handling, RBAC, JacORB, security-domain selection, and Weld conversation-state processing. The most externally reachable issue, `CVE-2014-7839`, allowed XML external entity expansion through a RESTEasy endpoint, potentially exposing files readable by the application-server account. The updates also remediate `CVE-2014-7849`, through which an authenticated RBAC Maintainer could alter a limited set of protected attributes, and `CVE-2014-7853`, which exposed sensitive security-domain data to authenticated users with incorrectly sufficient attribute permissions. Organizations should apply the relevant RHSA-2015:0215, RHSA-2015:0216, or RHSA-2015:0218 packages—including the RHEL 5 component updates—and restart JBoss server processes to activate the fixes.
Aug 29, 2026
Red Hat released Moderate-severity updates for JBoss Enterprise Application Platform (EAP) 6.2 on Red Hat Enterprise Linux 5 and 6, advancing deployments from version 6.2.3 to 6.2.4. The fixes address five vulnerabilities affecting Apache CXF and the JBoss JAX-RS implementation, including a SAML-token validation bypass, XML external entity (XXE) information disclosure, denial-of-service conditions, and potential plaintext credential exposure in a specific Apache CXF client-policy configuration. The XXE flaw, tracked as `CVE-2014-3481`, affects RESTEasy applications using JBoss EAP default context parameters that did not explicitly disable external-entity expansion. Unauthenticated attackers could submit crafted XML to applications accepting XML input to read local files, cause server-side HTTP requests that bypass network restrictions, or exhaust CPU and memory. Red Hat advised affected administrators to install the updated EAP packages, restart JBoss, preserve customized configurations, and review and merge any generated `.rpmnew` configuration changes.
Aug 29, 2026
Red Hat released **JBoss Enterprise Application Platform (EAP) 6.2.1** to replace EAP 6.2.0 and remediate three Moderate-impact vulnerabilities. `CVE-2013-6440` affects OpenSAML/XMLTooling-J and allows externally supplied XML entities to be resolved, potentially enabling unauthenticated remote attackers to read files accessible to the application-server account and conduct further XXE attacks. `CVE-2013-4517` affects Apache Santuario XML Security for Java, where DTD processing during XML transforms can exhaust memory and cause an `OutOfMemoryError`. `CVE-2014-0018` permits deployed code running under a Java Security Manager to access the Modular Service Container service registry without required permission checks and alter JBoss internal server state. The fixes were delivered through RHSA-2014:0170 for RHEL 5, RHSA-2014:0171 for RHEL 6, and RHSA-2014:0172 for Customer Portal distributions. Organizations operating EAP 6.2.0 should upgrade to EAP 6.2.1, back up installations and deployed applications, review and merge locally modified configuration files preserved as `.rpmnew` where applicable, and restart the JBoss server process after installation.
Aug 31, 2026