CVE-2020-14326

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	RESTEasy	RESTEasy 4.5.6.Final

References

https://bugzilla.redhat.com/show_bug.cgi?id=1855826Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210713-0001/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1855826Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20210713-0001/Third Party Advisory

Timeline

Published: Jun 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143275.5A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower s CVE-2020-143283.3A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could CVE-2020-143293.3A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpo CVE-2020-14336.5An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF CVE-2020-143305.5An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content a CVE-2020-143316.6A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the CVE-2020-143325.5A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sens CVE-2020-143336.1A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, CVE-2020-143348.8A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to CVE-2020-143355.5A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This fl CVE-2020-143366.5A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allow CVE-2020-143375.8A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthentic