Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-29T13:19:42 io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash.

This is an Important flaw in Quarkus REST / RESTEasy Reactive's MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service. By sending a crafted multipart/form-data request with an excessively large part-header section, the attacker can exhaust the JVM heap, leading to application crashes. This vulnerability does not require valid form field names or authentication. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-operator-bundle:26.4.14-1 Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-rhel9:26.4-22 Red Hat build of Keycloak 26.4 2026-08-05T00:00:00Z RHSA-2026:50847 rhbk/keycloak-rhel9-operator:26.4-22 Red Hat build of Keycloak 26.4.14 2026-08-05T00:00:00Z RHSA-2026:50846 resteasy-reactive-common-processor Red Hat build of Keycloak 26.4.14 2026-08-05T00:00:00Z RHSA-2026:50846 rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-operator-bundle:26.6.5-1 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9:26.6-11 Red Hat build of Keycloak 26.6 2026-08-05T00:00:00Z RHSA-2026:50849 rhbk/keycloak-rhel9-operator:26.6-11 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 resteasy-reactive-common-processor Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat build of Keycloak 26.6.5 2026-08-05T00:00:00Z RHSA-2026:50848 rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat build of Quarkus 3.27.4.SP3 2026-07-29T00:00:00Z RHSA-2026:47189 resteasy-reactive-client-processor Red Hat build of Quarkus 3.33.2.SP3 2026-07-30T00:00:00Z RHSA-2026:47172 resteasy-reactive-client-processor Streams for Apache Kafka 3.2.1 2026-08-12T00:00:00Z RHSA-2026:54435 resteasy-reactive-client-processor Streams for Apache Kafka 3.2.1 2026-08-12T00:00:00Z RHSA-2026:54435 resteasy-reactive-common-processor Cryostat 4 Affected resteasy-reactive-client-processor Cryostat 4 Affected resteasy-reactive-common-processor Red Hat build of Apache Camel 4 for Quarkus 3 Affected resteasy-reactive-client-processor Red Hat build of Apache Camel 4 for Quarkus 3 Affected resteasy-reactive-common-processor Red Hat build of Apicurio Registry 3 Not affected resteasy-reactive-common-processor Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected resteasy-reactive-client-processor Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected resteasy-reactive-common Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected resteasy-reactive-common-processor Red Hat OpenShift AI (RHOAI) Under investigation rhoai/odh-trustyai-service-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/multicluster-redirector-rhel9 streams for Apache Kafka 2 Affected resteasy-reactive-client-processor streams for Apache Kafka 2 Affected resteasy-reactive-common-processor https://www.cve.org/CVERecord?id=CVE-2026-16308 https://nvd.nist.gov/vuln/detail/CVE-2026-16308