High

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Type: advisorySource: Official CVE List1 source record

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Announced 18 Sept 2026Source revision 1

Original source ↗

CVE-2026-89059

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-89059

Red Hat build of Quarkus 3.27.6.redhat

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.33.4.redhat

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apicurio Registry 3

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Debezium 3

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Certificate System 10

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Certificate System 11

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 8

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Fuse 7

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Fuse 7

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 8

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform Expansion Pack

Source reference: /containers/cna/affected/22/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Satellite 6

Source reference: /containers/cna/affected/23/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/24/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "6.2.19.Final",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "7.0.0.Alpha1",
        "lessThan": "7.0.5.Final",
        "versionType": "maven"
      }
    ],
    "packageName": "RESTEasy",
    "collectionURL": "https://github.com/resteasy/resteasy",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.27::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.27.6.redhat",
    "versions": [
      {
        "status": "unaffected",
        "version": "6.2.19.Final-redhat-00003",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "org.jboss.resteasy/resteasy-core",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.33::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.33.4.redhat",
    "versions": [
      {
        "status": "unaffected",
        "version": "6.2.19.Final-redhat-00003",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "org.jboss.resteasy/resteasy-core",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.0.26-20.el9_8.1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "resteasy",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:apicurio_registry:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apicurio Registry 3",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:debezium:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Debezium 3",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "rhbk/keycloak-rhel9-operator",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:certificate_system:10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Certificate System 10",
    "packageName": "redhat-pki:10/redhat-pki",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:certificate_system:11"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Certificate System 11",
    "packageName": "redhat-pki",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "packageName": "dogtag-pki",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "packageName": "pki-core:10.6/pki-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "jackson-jaxrs-providers",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "packageName": "pki-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7",
    "packageName": "resteasy-jaxrs",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "packageName": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "packageName": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "packageName": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7",
    "packageName": "resteasy-jaxrs",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jbosseapxp"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "packageName": "resteasy-core",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:satellite:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Satellite 6",
    "packageName": "candlepin",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7",
    "packageName": "resteasy-jaxrs",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  }
]

Related CVEs: CVE-2026-89059
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #38942 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 10:38:12 GMT
Publisher date: Fri, 18 Sep 2026 07:13:39 GMT

Read the original announcement