Red Hat Product Errata RHSA-2026:85234 - Security Advisory
Issued:
2026-10-19
Updated:
2026-10-19

RHSA-2026:85234 - Security Advisory

Synopsis

Important: resteasy security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for resteasy is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

  • BZ - 2519756 - CVE-2026-89059 resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)
  • BZ - 2519775 - CVE-2026-89058 resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config

Red Hat Enterprise Linux for x86_64 9

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
x86_64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
x86_64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
s390x
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
s390x
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for Power, little endian 9

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
ppc64le
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
ppc64le
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for ARM 64 9

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
aarch64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
aarch64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
ppc64le
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
x86_64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
aarch64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
s390x
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
x86_64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
aarch64
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
ppc64le
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8

SRPM
resteasy-3.0.26-20.el9_8.1.src.rpm SHA-256: 0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb
s390x
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 41ad52217c12caa35fe9544126decdb8c2e402af6214df33860abdec8c7b41e9
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm SHA-256: 4b2231e8c9198f8b2bdf9f27706a60abdfa0c158b604f7b3462f706aa165ba59
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm SHA-256: f3ca91272f2130de8d5cc149137825a8df9621e018866388a46556561dbb03cb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.