CVE-2026-89059highCWE-409

CVE-2026-89059: falha de alta gravidade em Red Hat RESTEasy

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Enterprise Linux+ Monitorar Red Hat build of Keycloak

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.9%
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3Red Hat · Red Hat build of Apicurio Registry 3Red Hat · Red Hat build of Debezium 3Red Hat · Red Hat Build of KeycloakRed Hat · Red Hat build of Quarkus 3.27.6.redhatRed Hat · Red Hat build of Quarkus 3.33.4.redhatRed Hat · Red Hat Certificate System 10Red Hat · Red Hat Certificate System 11Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Fuse 7Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform 8.1Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat · Red Hat Satellite 6Red Hat · Red Hat Single Sign-On 7Red Hat · RESTEasy
CVEs relacionadas — Red Hat RESTEasy

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.6%CVE-2026-93569HIGHIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityEPSS 2.2%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%CVE-2024-1023MEDIUMIo.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertxEPSS 1.7%CVE-2024-3884HIGHUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedEPSS 1.5%