CVE-2024-1726
Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
5.3
Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
- Record
CVE-2024-1726- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
EUVDEUVD-2024-1255
5.3
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
- Record
EUVD-2024-1255- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mv64-86g8-cqq7
5.3
Quarkus: security checks in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
- Record
GHSA-mv64-86g8-cqq7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
NVD
5.3
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
- Record
CVE-2024-1726- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
OSV
5.3
Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
- Record
CVE-2024-1726- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
OSVGHSA-mv64-86g8-cqq7
5.3
Quarkus: security checks in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
- Record
GHSA-mv64-86g8-cqq7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus.resteasy.reactive:resteasy-reactiveMaven |
3.8.0.CR1 to 3.8.0.CR1 | 3.8.0 |
io.quarkus.resteasy.reactive:resteasy-reactiveMaven |
3.3.0.CR1 up to 3.7.4 | 3.7.4 |
io.quarkus.resteasy.reactive:resteasy-reactiveMaven |
before 3.2.11.Final | 3.2.11.Final |
io.quarkus.resteasy.reactive:resteasy-reactiveMaven |
3.8.0.CR1 up to 3.8.0 | 3.8.0 |
io.quarkus.resteasy.reactive:resteasy-reactiveMaven |
3.3.0.CR1 up to 3.7.4, plus listed versions 3.3.03.3.13.3.23.3.33.4.0 Show 25 moreShow less3.4.0.CR13.4.13.4.23.4.33.5.03.5.0.CR13.5.13.5.23.5.33.6.03.6.0.CR13.6.13.6.23.6.33.6.43.6.53.6.63.6.73.6.83.6.93.7.03.7.0.CR13.7.13.7.23.7.3 |
3.7.4 |
io.quarkus.resteasy.reactive:resteasy-reactiveMaven |
before 3.2.11.Final, plus listed versions 1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final Show 45 moreShow less1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final2.0.0.Alpha12.0.0.Alpha22.0.0.Alpha32.0.0.CR12.0.0.CR22.0.0.CR32.0.0.Final2.0.1.Final2.0.2.Final2.0.3.Final2.1.0.CR12.1.0.Final2.1.1.Final2.1.2.Final2.1.3.Final2.1.4.Final2.10.0.CR12.10.0.Final2.10.1.Final2.10.2.Final2.10.3.Final2.10.4.Final2.11.0.CR12.11.0.Final2.11.1.Final2.11.2.Final |
3.2.11.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1726 is a medium vulnerability (CVSS 5.3) in Red Hat Build Of Quarkus, published April 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in io.quarkus.resteasy.reactive:resteasy-reactive 3.8.0.
References
access.redhat.com/errata/RHSA-2024:1662
access.redhat.com/security/cve/CVE-2024-1726
bugzilla.redhat.com/show_bug.cgi?id=2265158
nvd.nist.gov/vuln/detail/CVE-2024-1726
github.com/quarkusio/quarkus/commit/34c1a63baf5401d0d578a23a1a4deb4b841ce65b
github.com/quarkusio/quarkus/commit/96d93427f3b4a7d3cff34d8b7b883e13cecd359c
Left out here: 115 versions. The JSON record has them.