RESTEasy 6.2.20.Final, 7.0.6.Final and 8.0.0.Alpha1 Releases

By James R. Perkins | November 09, 2026

Today we would like to announce the release of RESTEasy 8.0.0.Alpha1, 7.0.6.Final and 6.2.20.Final. 7.0.6.Final and 6.2.20.Final address a security vulnerability, and we would encourage all users of those streams to upgrade.

We are excited that 8.0.0.Alpha1 is the first release of RESTEasy 8.0, which targets Jakarta REST 5.0. Jakarta REST 5.0 is currently at its M1 milestone and is slated for Jakarta EE 12. Both the specification and this release are early, so expect changes along the way. The biggest change is the CDI integration in RESTEASY-3807. Jakarta REST 5.0 requires CDI, so resources, providers and Application subclasses are now CDI beans, and CDI injects the Jakarta REST context types. @Context is implemented as a CDI qualifier, as proposed for the specification. This release also requires Java 21 and moves to Jakarta EL 6.0 and Expressly.

RESTEASY-3823 is an information disclosure in the default exception mapper tracked as CVE-2026-120971 (CVSS 5.3, Medium). For an unhandled exception, the mapper wrote the exception’s message to the body of the 500 response, which could expose internal details to clients. The vulnerability affects 6.2.19.Final and lower, and 7.0.5.Final and lower. It applies when an exception other than a WebApplicationException reaches the default exception mapper, meaning no application ExceptionMapper covers the exception type and dev.resteasy.exception.mapper is not set to false.

The fix changes behavior for everyone, not only for those who were exposed. Unhandled exceptions now return a 500 with no entity, so clients which read the message from the response body will get an empty body. Applications which want to return a message need to register their own ExceptionMapper.

Both 7.0.6.Final and 6.2.20.Final also remove the enhanced CDI integration added by RESTEASY-3755, in RESTEASY-3822. This removes CDI injection of @*Param values and of @Context members through CDI, along with the dev.resteasy.cdi.enhanced.enabled property. It was added in error in 7.0.3.Final and 6.2.17.Final, and it caused issues which can only be fixed by the new integration in RESTEasy 8.0. On 7.0 it was enabled by default, while on 6.2 only applications which set the property to true are affected.

8.0.0.Alpha1

RESTEasy 8.0.0.Alpha1 is an early Jakarta REST 5.0 implementation, built against the 5.0.0-M1 API. This release includes the Jakarta REST 5.0 CDI integration, implementations of the new Jakarta REST 5.0 API methods such as getHeaderString(String, String) and the Java 21 baseline.

Enhancement

  • RESTEASY-3313 ContextualExecutor worker submitting to itself still invokes classpath scan

  • RESTEASY-3807 Jakarta REST 5.0 CDI Integration

  • RESTEASY-3829 Implement getHeaderString(String, String) for Jakarta REST 5.0

Bug

  • RESTEASY-3802 The resteasy-undertow-cdi integration does not provide a RestasyConfiguration in the context

  • RESTEASY-3803 WebTarget’s resolveTemplates fails with PatternSyntaxException

  • RESTEASY-3806 UriBuilder.resolveTemplates() throws NullPointerException instead of IllegalArgumentException for null-key checks on null-hostile maps (e.g. Map.of())

  • RESTEASY-3816 RegisterBuiltin client provider factory cache can leak deployment class loaders

  • RESTEASY-3823 Default Exception Mapper Discloses Internal Exception Messages

Component Upgrade

  • RESTEASY-3804 Bump com.fasterxml.jackson:jackson-bom from 2.21.6 to 2.21.7 in the fasterxml-dependencies group across 1 directory

  • RESTEASY-3805 Bump org.wildfly.security:wildfly-elytron-ssl from 2.6.10.Final to 2.6.12.Final

  • RESTEASY-3810 Bump commons-codec:commons-codec from 1.22.1 to 1.23.0

  • RESTEASY-3812 Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.3 to 3.0.4 in the jakarta-json-dependencies group

  • RESTEASY-3813 Bump the fasterxml-dependencies group across 1 directory with 2 updates

  • RESTEASY-3815 Bump org.hibernate.validator:hibernate-validator from 9.0.1.Final to 9.0.2.Final

  • RESTEASY-3826 Bump version.io.undertow from 2.3.26.Final to 2.3.27.Final

  • RESTEASY-3827 Bump version.org.hibernate.validator from 9.0.2.Final to 9.0.3.Final

  • RESTEASY-3828 Bump com.google.guava:guava from 33.4.8-jre to 33.7.1-jre in /resteasy-dependencies-bom

  • RESTEASY-3831 Bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre in the guava-dependencies group

Task

Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v8.0.0.Alpha1.

7.0.6.Final

RESTEasy 7.0.6.Final is a Jakarta REST 4.0 implementation. This release includes a security fix, the removal of the enhanced CDI integration, CDI resource lookup fixes, UriBuilder and WebTarget template fixes, a class loader leak fix and component upgrades.

Enhancement

  • RESTEASY-3313 ContextualExecutor worker submitting to itself still invokes classpath scan

Bug

  • RESTEASY-3802 The resteasy-undertow-cdi integration does not provide a RestasyConfiguration in the context

  • RESTEASY-3803 WebTarget’s resolveTemplates fails with PatternSyntaxException

  • RESTEASY-3806 UriBuilder.resolveTemplates() throws NullPointerException instead of IllegalArgumentException for null-key checks on null-hostile maps (e.g. Map.of())

  • RESTEASY-3816 RegisterBuiltin client provider factory cache can leak deployment class loaders

  • RESTEASY-3817 Push and restore the Configuration for a client invocation

  • RESTEASY-3819 CDI resource lookup fails for resource subclasses and ignores enabled alternatives

  • RESTEASY-3821 ResourceContext.getResource() fails for a CDI bean with only an @Inject constructor

  • RESTEASY-3822 Revert the enhanced CDI integration added by RESTEASY-3755

  • RESTEASY-3823 Default Exception Mapper Discloses Internal Exception Messages

  • RESTEASY-3824 A failed deployment start leaves its ResteasyProviderFactory as the global instance

Component Upgrade

  • RESTEASY-3804 Bump com.fasterxml.jackson:jackson-bom from 2.21.6 to 2.21.7 in the fasterxml-dependencies group across 1 directory

  • RESTEASY-3805 Bump org.wildfly.security:wildfly-elytron-ssl from 2.6.10.Final to 2.6.12.Final

  • RESTEASY-3810 Bump commons-codec:commons-codec from 1.22.1 to 1.23.0

  • RESTEASY-3812 Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.3 to 3.0.4 in the jakarta-json-dependencies group

  • RESTEASY-3813 Bump the fasterxml-dependencies group across 1 directory with 2 updates

  • RESTEASY-3815 Bump org.hibernate.validator:hibernate-validator from 9.0.1.Final to 9.0.2.Final

  • RESTEASY-3826 Bump version.io.undertow from 2.3.26.Final to 2.3.27.Final

  • RESTEASY-3827 Bump version.org.hibernate.validator from 9.0.2.Final to 9.0.3.Final

Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v7.0.6.Final.

6.2.20.Final

RESTEasy 6.2.20.Final is a Jakarta REST 3.1 implementation. This release includes a security fix, the removal of the enhanced CDI integration, CDI resource lookup fixes and component upgrades.

Bug

  • RESTEASY-3802 The resteasy-undertow-cdi integration does not provide a RestasyConfiguration in the context

  • RESTEASY-3817 Push and restore the Configuration for a client invocation

  • RESTEASY-3819 CDI resource lookup fails for resource subclasses and ignores enabled alternatives

  • RESTEASY-3821 ResourceContext.getResource() fails for a CDI bean with only an @Inject constructor

  • RESTEASY-3822 Revert the enhanced CDI integration added by RESTEASY-3755

  • RESTEASY-3823 Default Exception Mapper Discloses Internal Exception Messages

  • RESTEASY-3824 A failed deployment start leaves its ResteasyProviderFactory as the global instance

Component Upgrade

  • RESTEASY-3801 Bump com.fasterxml.jackson:jackson-bom from 2.18.10 to 2.18.11 in the fasterxml-dependencies group across 1 directory

  • RESTEASY-3805 Bump org.wildfly.security:wildfly-elytron-ssl from 2.6.10.Final to 2.6.12.Final

  • RESTEASY-3810 Bump commons-codec:commons-codec from 1.22.1 to 1.23.0

  • RESTEASY-3811 Bump version.io.netty.netty4 from 4.1.138.Final to 4.1.139.Final

  • RESTEASY-3812 Bump jakarta.json.bind:jakarta.json.bind-api from 3.0.3 to 3.0.4 in the jakarta-json-dependencies group

  • RESTEASY-3813 Bump the fasterxml-dependencies group across 1 directory with 2 updates

  • RESTEASY-3814 Bump org.hibernate.validator:hibernate-validator from 8.0.5.Final to 8.0.6.Final

  • RESTEASY-3826 Bump version.io.undertow from 2.3.26.Final to 2.3.27.Final

  • RESTEASY-3830 Bump version.io.netty.netty4 from 4.1.139.Final to 4.1.140.Final

Full release notes can be found at https://github.com/resteasy/resteasy/releases/tag/v6.2.20.Final.

Finally

As always, feedback is welcome. Stay safe, and, depending on where you are, stay warm or be cool.

Apache License 2.0 Security
Copyright © RESTEasy. All rights reserved. For details on our trademarks, please visit our Trademark Policy and Trademark List. Trademarks of third parties are owned by their respective holders and their mention here does not suggest any endorsement or association.