Skip to content
Fencer Vulns
high 7.5

CVE-2026-89059 json

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

published 2026-09-18 52 d ago modified 2026-11-09 6 h ago also EUVD-2026-82735

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Patch / fix

  • Red Hat Red Hat Build of Apache Camel 3.33.4.redhat 6.2.19.Final-redhat-00003
  • Red Hat Red Hat build of Quarkus 3.27.6.redhat 6.2.19.Final-redhat-00003
  • Red Hat Red Hat build of Quarkus 3.33.4.redhat 6.2.19.Final-redhat-00003
  • Red Hat Red Hat Enterprise Linux 10 0:11.9.0-6.el10_2.1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:11.6.0-3.el10_0.2
  • Red Hat Red Hat Enterprise Linux 9 0:3.0.26-20.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:3.0.26-16.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:3.0.26-20.el9_4.2
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:3.0.26-20.el9_6.2
  • resteasy RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-core RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-client RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-jackson2-provider RHEL 9 3.0.26-20.el9_8.1
  • pki-resteasy-servlet-initializer RHEL 9 3.0.26-20.el9_8.1

red hat advisories RHSA-2026:85234

  • idm-pki-ca AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-kra AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-acme AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-base AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-java AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-tools AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • idm-pki-server AlmaLinux 10 11.9.0-6.el10_2.1.alma.1
  • python3-idm-pki AlmaLinux 10 11.9.0-6.el10_2.1.alma.1

almalinux advisories ALSA-2026:92408ALSA-2026:85234

  • dogtag-pki Rocky Linux 10 11.9.0-6.el10_2.1.rocky.0.1
  • resteasy Rocky Linux 9 3.0.26-20.el9_8.1

rocky linux advisories RLSA-2026:92408RLSA-2026:85234

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-89059 updated cvss 7.5

resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)

  • Red Hat build of Apache Camel 4 for Quarkus 3 resteasy-core Red Hat build of Apicurio Registry 3 resteasy-core Red Hat build of Debezium 3 resteasy-core Red Hat Build of Keycloak resteasy-core, rhbk/keycloak-rhel9-operator
    affected: no fix available
  • Red Hat Certificate System 10 redhat-pki Red Hat Certificate System 11 redhat-pki Red Hat Fuse 7 resteasy-core, resteasy-jaxrs Red Hat JBoss Enterprise Application Platform 7 resteasy-jaxrs, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack resteasy-core
    affected: no fix available
  • Red Hat Single Sign-On 7 resteasy-jaxrs
    affected: no fix planned “Will not fix”
  • Red Hat Build of Apache Camel 3.33.4.redhat resteasy-core 6.2.19.Final-redhat-00003
    fixed: vendor fix RHSA-2026:83670
  • Red Hat build of Quarkus 3.27.6.redhat resteasy-core 6.2.19.Final-redhat-00003
    fixed: vendor fix RHSA-2026:83082
  • Red Hat build of Quarkus 3.33.4.redhat resteasy-core 6.2.19.Final-redhat-00003
    fixed: vendor fix RHSA-2026:83520
  • Red Hat Enterprise Linux AppStream (v. 9) resteasy 3.0.26-20.el9_8.1, pki-resteasy-core 3.0.26-20.el9_8.1, pki-resteasy-client 3.0.26-20.el9_8.1, pki-resteasy-jackson2-provider 3.0.26-20.el9_8.1, pki-resteasy-servlet-initializer 3.0.26-20.el9_8.1
    fixed: vendor fix RHSA-2026:85234
show 10 more
  • Red Hat Enterprise Linux AppStream (v. 10) dogtag-pki 11.9.0-6.el10_2.1, idm-pki-ca 11.9.0-6.el10_2.1, idm-pki-kra 11.9.0-6.el10_2.1, idm-pki-acme 11.9.0-6.el10_2.1, idm-pki-base 11.9.0-6.el10_2.1, idm-pki-java 11.9.0-6.el10_2.1, +3 more
    fixed: vendor fix RHSA-2026:92408
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) resteasy 3.0.26-16.el9_2.1, pki-resteasy-core 3.0.26-16.el9_2.1, pki-resteasy-client 3.0.26-16.el9_2.1, pki-resteasy-jackson2-provider 3.0.26-16.el9_2.1
    fixed: vendor fix RHSA-2026:96077
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) resteasy 3.0.26-20.el9_4.2, pki-resteasy-core 3.0.26-20.el9_4.2, pki-resteasy-client 3.0.26-20.el9_4.2, pki-resteasy-jackson2-provider 3.0.26-20.el9_4.2, pki-resteasy-servlet-initializer 3.0.26-20.el9_4.2
    fixed: vendor fix RHSA-2026:95505
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) dogtag-pki 11.6.0-3.el10_0.2, idm-pki-ca 11.6.0-3.el10_0.2, idm-pki-kra 11.6.0-3.el10_0.2, idm-pki-acme 11.6.0-3.el10_0.2, idm-pki-base 11.6.0-3.el10_0.2, idm-pki-java 11.6.0-3.el10_0.2, +3 more
    fixed: vendor fix RHSA-2026:95466
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) resteasy 3.0.26-20.el9_6.2, pki-resteasy-core 3.0.26-20.el9_6.2, pki-resteasy-client 3.0.26-20.el9_6.2, pki-resteasy-jackson2-provider 3.0.26-20.el9_6.2, pki-resteasy-servlet-initializer 3.0.26-20.el9_6.2
    fixed: vendor fix RHSA-2026:95504
  • Red Hat JBoss Enterprise Application Platform 8.1
    fixed: vendor fix RHSA-2026:95221
  • Red Hat Build of Apache Camel 3.33.4.redhat jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more Red Hat build of Quarkus 3.27.6.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.4.redhat jna 5.8.0, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, wasm 2.15.3, +1016 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more
    not affected: component not present
  • Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +16 more
    not affected: vulnerable code not present
  • Red Hat Satellite 6 candlepin, candlepin-selinux
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
51 d ago

Exploit prediction

1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2519756 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat Red Hat build of Quarkus 3.33.4.redhat
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Certificate System 10
  • Red Hat Red Hat Certificate System 11
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.