CVE-2014-3490: RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platf...

Security readout for executives and security teams

CVE-2014-3490 is an XML External Entity flaw in RESTEasy. In affected versions, a setting meant to stop entity expansion did not fully disable external entities, potentially allowing remote attackers to read arbitrary files. The issue also affects RESTEasy as used in Red Hat JBoss EAP 6.3.0. Exposure is most likely in Java applications using vulnerable RESTEasy versions, especially Red Hat JBoss Enterprise Application Platform 6.3.0 deployments. Public affected-product metadata in the bundle is incomplete, so teams should verify by dependency and platform inventory. Prioritize remediation where RESTEasy handles external input, especially public services. The business risk is unauthorized file disclosure from application servers. Evidence of active exploitation is not provided, but the impact justifies prompt inventory and patch confirmation. Mitigation focus: Upgrade RESTEasy to 2.3.8.SP2, 3.0.9, or later vendor-supported versions.; Apply relevant Red Hat advisories for JBoss EAP and bundled RESTEasy packages.; Check Oracle or other downstream vendor guidance if RESTEasy is embedded indirectly..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.