Description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | RESTEasy | < 6.2.19.Final, 7.0.0.Alpha1 – < 7.0.5.Final | 6.2.19.Final |
| Red Hat | Red Hat Build of Apache Camel 3.33.4.redhat | — | — |
| Red Hat | Red Hat build of Quarkus 3.27.6.redhat | — | — |
| Red Hat | Red Hat build of Quarkus 3.33.4.redhat | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | — | — |
| Red Hat | Red Hat build of Debezium 3 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat Certificate System 10 | — | — |
| Red Hat | Red Hat Certificate System 11 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | resteasy3.0 | No fix yet | — |
| Debian 13 | resteasy3.0 | No fix yet | — |
| Debian 12 | resteasy3.0 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | resteasy +1 | No fix yet | — |
| Ubuntu 26.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu 24.04 LTS | resteasy3.0 | No fix yet | — |
| Ubuntu 22.04 LTS | resteasy3.0 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | resteasy | No fix yet | — |
| Ubuntu Pro 22.04 LTS | resteasy | No fix yet | — |
| Ubuntu Pro 20.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | resteasy3.0 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | resteasy | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | resteasy +4 | 3.0.26-20.el9_8.1 | RHSA-2026:85234 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | idm-pki-ca +7 | 11.9.0-6.el10_2.1.alma.1 | ALSA-2026:92408 |
| AlmaLinux 9 | pki-resteasy-core +3 | 3.0.26-20.el9_8.1 | ALSA-2026:85234 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dogtag-pki | 11.9.0-6.el10_2.1.rocky.0.1 | RLSA-2026:92408 |
| Rocky Linux 9 | resteasy | 3.0.26-20.el9_8.1 | RLSA-2026:98494, RLSA-2026:85234 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | idm-pki-ca +7 | 11.9.0-6.0.1.el10_2.1 | ELSA-2026-92408 |
| Oracle Linux 9 | pki-resteasy-core +3 | 3.0.26-20.el9_8.1 | ELSA-2026-85234 |
Advisories 9
- RLSA-2026:98494 Important: resteasy security update Rocky Linux Security Advisories · Nov 12, 2026
- WID-SEC-2026-4029 Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- ALSA-2026:92408 Important: dogtag-pki security update AlmaLinux Security Advisories · Oct 30, 2026
- RLSA-2026:92408 Important: dogtag-pki security update Rocky Linux Security Advisories · Oct 30, 2026
- ALSA-2026:85234 Important: resteasy security update AlmaLinux Security Advisories · Oct 29, 2026
- ELSA-2026-92408 Important: dogtag-pki security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 29, 2026
- RLSA-2026:85234 Important: resteasy security update Rocky Linux Security Advisories · Oct 20, 2026
- RHSA-2026:85234 Red Hat Security Advisory: resteasy security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-85234 Important: resteasy security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 19, 2026
References
- RHSA-2026:83082 vendor-advisory
- RHSA-2026:83520 vendor-advisory
- RHSA-2026:83670 vendor-advisory
- RHSA-2026:85234 vendor-advisory
- RHSA-2026:92408 vendor-advisory
- RHSA-2026:95221 vendor-advisory
- RHSA-2026:95466 vendor-advisory
- RHSA-2026:95504 vendor-advisory
- RHSA-2026:95505 vendor-advisory
- RHSA-2026:95887 vendor-advisory
- RHSA-2026:96077 vendor-advisory
- RHSA-2026:98494 vendor-advisory
- RHSA-2026:98606 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-89059 vdb-entry
- RHBZ#2519756 issue-tracking
- https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb
- https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2