Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-17T14:00:00 resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-409

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Red Hat would like to thank Yu Bao (PayPal Cyber Security Team) for reporting this issue. Red Hat build of Apache Camel 4 for Quarkus 3 Affected resteasy-core Red Hat build of Apicurio Registry 3 Affected resteasy-core Red Hat build of Debezium 3 Affected resteasy-core Red Hat Build of Keycloak Affected resteasy-core Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9-operator Red Hat build of Quarkus Affected resteasy-core Red Hat Certificate System 10 Affected redhat-pki:10/redhat-pki Red Hat Certificate System 11 Affected redhat-pki Red Hat Enterprise Linux 10 Affected dogtag-pki Red Hat Enterprise Linux 8 Affected pki-core:10.6/pki-core Red Hat Enterprise Linux 9 Affected jackson-jaxrs-providers Red Hat Enterprise Linux 9 Affected pki-core Red Hat Fuse 7 Will not fix resteasy-core Red Hat Fuse 7 Will not fix resteasy-jaxrs Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 7 Will not fix resteasy-jaxrs Red Hat JBoss Enterprise Application Platform 8 Affected resteasy-core Red Hat JBoss Enterprise Application Platform Expansion Pack Affected resteasy-core Red Hat Satellite 6 Affected candlepin Red Hat Single Sign-On 7 Affected resteasy-jaxrs https://www.cve.org/CVERecord?id=CVE-2026-89059 https://nvd.nist.gov/vuln/detail/CVE-2026-89059 https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2