Every CVE Search/ Get API key

CVE-2024-1726

Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service

5.3 MediumFix available

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.73%Up 0.7 points since Apr 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Record
CVE-2024-1726
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-281
Updated
2026-11-02
EUVDEUVD-2024-1255 5.3

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Record
EUVD-2024-1255
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-mv64-86g8-cqq7 5.3

Quarkus: security checks in resteasy reactive may trigger a denial of service

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Record
GHSA-mv64-86g8-cqq7
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-281
Updated
2026-11-02
NVD 5.3

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Record
CVE-2024-1726
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-281
Updated
2026-11-02
OSV 5.3

Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Record
CVE-2024-1726
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-281
Updated
2026-11-02
OSVGHSA-mv64-86g8-cqq7 5.3

Quarkus: security checks in resteasy reactive may trigger a denial of service

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Record
GHSA-mv64-86g8-cqq7
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-281
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
io.quarkus.resteasy.reactive:resteasy-reactive
Maven
3.8.0.CR1 to 3.8.0.CR1
3.8.0
io.quarkus.resteasy.reactive:resteasy-reactive
Maven
3.3.0.CR1 up to 3.7.4
3.7.4
io.quarkus.resteasy.reactive:resteasy-reactive
Maven
before 3.2.11.Final
3.2.11.Final
io.quarkus.resteasy.reactive:resteasy-reactive
Maven
3.8.0.CR1 up to 3.8.0
3.8.0
io.quarkus.resteasy.reactive:resteasy-reactive
Maven
3.3.0.CR1 up to 3.7.4, plus listed versions
3.3.03.3.13.3.23.3.33.4.0
Show 25 moreShow less
3.4.0.CR13.4.13.4.23.4.33.5.03.5.0.CR13.5.13.5.23.5.33.6.03.6.0.CR13.6.13.6.23.6.33.6.43.6.53.6.63.6.73.6.83.6.93.7.03.7.0.CR13.7.13.7.23.7.3
3.7.4
io.quarkus.resteasy.reactive:resteasy-reactive
Maven
before 3.2.11.Final, plus listed versions
1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final
Show 45 moreShow less
1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final2.0.0.Alpha12.0.0.Alpha22.0.0.Alpha32.0.0.CR12.0.0.CR22.0.0.CR32.0.0.Final2.0.1.Final2.0.2.Final2.0.3.Final2.1.0.CR12.1.0.Final2.1.1.Final2.1.2.Final2.1.3.Final2.1.4.Final2.10.0.CR12.10.0.Final2.10.1.Final2.10.2.Final2.10.3.Final2.10.4.Final2.11.0.CR12.11.0.Final2.11.1.Final2.11.2.Final
3.2.11.Final

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-1726 is a medium vulnerability (CVSS 5.3) in Red Hat Build Of Quarkus, published April 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in io.quarkus.resteasy.reactive:resteasy-reactive 3.8.0.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 115 versions. The JSON record has them.

MoveEnter Open