RESTEasy wraps the ServletOutputStream with the HttpServletResponseWrapper.DeferredOutputStream. In Undertow, or WildFly, the handler ServletRequestContext is used and requires "java.lang.RuntimePermission" "io.undertow.servlet.GET_CURRENT_REQUEST" access. Users should not have to add this permissions in order for RESTEasy to work.