CVE-2026-89058 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

[
  {
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "6.2.19.Final",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "7.0.0.Alpha1",
        "lessThan": "7.0.5.Final",
        "versionType": "maven"
      }
    ],
    "packageName": "RESTEasy",
    "collectionURL": "https://github.com/resteasy/resteasy",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Apicurio Registry 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:apicurio_registry:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Debezium 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:debezium:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhbk/keycloak-rhel9-operator",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:quarkus:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Certificate System 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "redhat-pki:10/redhat-pki",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:certificate_system:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Certificate System 11",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "redhat-pki",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:certificate_system:11"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "dogtag-pki",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "pki-core:10.6/pki-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "jackson-jaxrs-providers",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "pki-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-jaxrs",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "resteasy-jaxrs",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "packageName": "resteasy-core",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "candlepin",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:satellite:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "resteasy-jaxrs",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7"
    ]
  }
]