CVE-2026-89059
Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.5% · top 25% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected < 6.2.19.Final
- affected 7.0.0.Alpha1 – < 7.0.5.Final
Red Hat · Red Hat Build of Apache Camel 3.33.4.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat build of Quarkus 3.27.6.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat build of Quarkus 3.33.4.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:11.9.0-6.el10_2.1 – < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support
- unaffected 0:11.6.0-3.el10_0.2 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:3.0.26-20.el9_8.1 – < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- unaffected 0:3.0.26-20.el9_4.2 – < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support
- unaffected 0:3.0.26-20.el9_6.2 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1
All versions: unaffected
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1
All versions: unaffected
Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3
All versions: affected
Red Hat · Red Hat build of Apicurio Registry 3
All versions: affected
Red Hat · Red Hat build of Debezium 3
All versions: affected
Red Hat · Red Hat Build of Keycloak
All versions: affected
Red Hat · Red Hat Build of Keycloak
All versions: affected
Red Hat · Red Hat Certificate System 10
All versions: affected
Red Hat · Red Hat Certificate System 11
All versions: affected
Red Hat · Red Hat Enterprise Linux 8
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
All versions: affected
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
All versions: affected
All versions: unaffected
Red Hat · Red Hat Single Sign-On 7
All versions: affected
References (14)
- RHSA-2026:83082 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:83520 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:83670 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:85234 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:92408 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95221 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95466 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95504 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95505 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95887 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-89059 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2519756 (opens in a new tab)issue-trackingx_refsource_REDHATexploit
- https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb (opens in a new tab)
- https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2 (opens in a new tab)exploit
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-89059)Record last updated .