7.5
High
CVE-2026-89059 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
Description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat 7.0 | 7.0.0.Alpha1 → < 7.0.5.Final | 7.0.5.Final |
| Red Hat 6.2 | earliest → < 6.2.19.Final | 6.2.19.Final |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat build of Debezium 3 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Quarkus | Versions not published | |
| Red Hat Certificate System 10 | Versions not published | |
| Red Hat Certificate System 11 | Versions not published |