Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-89059

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat RESTEasy

Default version status: unaffected

  • 0 to < 6.2.19.Finalaffected
  • 7.0.0.Alpha1 to < 7.0.5.Finalaffected

Red Hat Red Hat build of Quarkus 3.27.6.redhat

Default version status: affected

  • 6.2.19.Final-redhat-00003 to < *unaffected

Red Hat Red Hat build of Quarkus 3.33.4.redhat

Default version status: affected

  • 6.2.19.Final-redhat-00003 to < *unaffected

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:11.9.0-6.el10_2.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:3.0.26-20.el9_8.1 to < *unaffected

Red Hat Red Hat build of Apache Camel 4 for Quarkus 3

Default version status: affected

Red Hat Red Hat build of Apicurio Registry 3

Default version status: affected

Red Hat Red Hat build of Debezium 3

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat Build of Keycloak

Default version status: affected

Red Hat Red Hat Certificate System 10

Default version status: affected

Red Hat Red Hat Certificate System 11

Default version status: affected

Red Hat Red Hat Enterprise Linux 8

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: unaffected

Red Hat Red Hat Fuse 7

Default version status: affected

Red Hat Red Hat Fuse 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: affected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: affected

References