Loading vulnerability…
RESTEasy GZIPInterceptor Denial of Service
CVE-2016-6346 is a denial-of-service vulnerability in RESTEasy caused by GZIPInterceptor being enabled when it is not required. A remote attacker can abuse the unnecessarily enabled compression interceptor to exhaust resources and disrupt availability of an application using the affected RESTEasy component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes a denial-of-service condition with high availability impact. No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Where updates cannot be applied immediately, disable or avoid enabling RESTEasy GZIPInterceptor unless compression support is required, and apply request-rate and resource-consumption controls at the application or reverse-proxy layer.
Patch, then assume compromise.
Update RESTEasy or the affected vendor product to a release containing the fix. Fixed Red Hat product updates include JBoss EAP 6.4.14, JBoss EAP 7.0.9, JBoss EAP 7.1.0, Red Hat Satellite 6.5 with candlepin 2.5.8, and the applicable JBoss BPM Suite and JBoss BRMS security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.