Description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Published: 2026-09-18
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Title Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
First Time appeared Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat certificate System
Redhat debezium
Redhat enterprise Linux
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat quarkus
Redhat red Hat Single Sign On
Redhat satellite
Weaknesses CWE-409
CPEs cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:certificate_system:10
cpe:/a:redhat:certificate_system:11
cpe:/a:redhat:debezium:3
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/a:redhat:satellite:6
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat certificate System
Redhat debezium
Redhat enterprise Linux
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat jbosseapxp
Redhat quarkus
Redhat red Hat Single Sign On
Redhat satellite
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Apicurio Registry Build Keycloak Camel Quarkus Certificate System Debezium Enterprise Linux Jboss Enterprise Application Platform Jboss Fuse Jbosseapxp Quarkus Red Hat Single Sign On Satellite
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-18T07:13:39.763Z

Reserved: 2026-09-10T18:20:52.115Z

Link: CVE-2026-89059

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-18T08:17:01.783

Modified: 2026-09-18T08:17:01.783

Link: CVE-2026-89059

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)