Every CVE Search/ Get API key

CVE-2026-89059

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

7.5 High

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.53%Up 1.0 points since Sep 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Record
CVE-2026-89059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-06
EUVDEUVD-2026-82735 7.5

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Record
EUVD-2026-82735
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
NVD 7.5

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Record
CVE-2026-89059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-06
OSV 7.5

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Record
CVE-2026-89059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-409
Updated
2026-11-07
OSVDEBIAN-CVE-2026-89059 7.5

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Record
DEBIAN-CVE-2026-89059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-07
OSVRHSA-2026:85234 7.5

Red Hat Security Advisory: resteasy security update

Record
RHSA-2026:85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRLSA-2026:85234 7.5

Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)

  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:92408 7.5

Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

  • Certificate Authority (CA)
  • Key Recovery Authority (KRA)
  • Online Certificate Status Protocol (OCSP) Manager
  • Token Key Service (TKS)
  • Token Processing Service (TPS)
  • Automatic Certificate Management Environment (ACME) Responder
  • Enrollment over Secure Transport (EST) Responder

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)

  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

  • com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92408
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-89059 7.5

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Record
UBUNTU-CVE-2026-89059
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:85234 No score

Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:85234
Updated
2026-11-02
OSVALSA-2026:92408 No score

Important: dogtag-pki security update

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

  • Certificate Authority (CA)
  • Key Recovery Authority (KRA)
  • Online Certificate Status Protocol (OCSP) Manager
  • Token Key Service (TKS)
  • Token Processing Service (TPS)
  • Automatic Certificate Management Environment (ACME) Responder
  • Enrollment over Secure Transport (EST) Responder

Security Fix(es):

  • resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
  • resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
  • com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92408
Updated
2026-11-02

Affected products

Show 9 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
pki-resteasy-client
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
pki-resteasy-core
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
pki-resteasy-jackson2-provider
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
pki-resteasy-servlet-initializer
AlmaLinux:9
From an advisory covering 2 CVEs
 before 3.0.26-20.el9_8.1
3.0.26-20.el9_8.1
idm-pki-acme
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-base
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-ca
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-java
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-kra
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
idm-pki-server
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
idm-pki-tools
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
python3-idm-pki
AlmaLinux:10
From an advisory covering 3 CVEs
 before 11.9.0-6.el10_2.1.alma.1
11.9.0-6.el10_2.1.alma.1
resteasy3.0
Debian:12
 All versions, plus listed versions
3.0.26-6
 None known
resteasy3.0
Debian:13
 All versions, plus listed versions
3.0.26-6
 None known
resteasy3.0
Debian:14
 All versions, plus listed versions
3.0.26-6
 None known
pki-resteasy-client
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
pki-resteasy-core
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
pki-resteasy-jackson2-provider
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
pki-resteasy-servlet-initializer
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
resteasy
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
resteasy
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:3.0.26-20.el9_8.1
0:3.0.26-20.el9_8.1
dogtag-pki
Rocky Linux:10
From an advisory covering 3 CVEs
 before 0:11.9.0-6.el10_2.1.rocky.0.1
0:11.9.0-6.el10_2.1.rocky.0.1
resteasy
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.0.6-33.0.6-3ubuntu0.1~esm1
 None known
resteasy3.0
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.0.19-13.0.19-23.0.26-1~18.043.0.26-1~18.04.1~esm1
 None known
resteasy
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2ubuntu0.20.04.1~esm1
 None known
resteasy3.0
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.0.26-13.0.26-1ubuntu0.1~esm1
 None known
resteasy3.0
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.0.26-23.0.26-33.0.26-3ubuntu0.1
 None known
resteasy
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2ubuntu0.22.04.1~esm1
 None known
resteasy3.0
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.0.26-63.0.26-6ubuntu0.24.04.1
 None known
resteasy
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2ubuntu0.24.04.1~esm1
 None known
resteasy
Ubuntu:26.10
 All versions, plus listed versions
3.6.2-4
 None known
resteasy3.0
Ubuntu:26.10
 All versions, plus listed versions
3.0.26-6
 None known
resteasy
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.2-33.6.2-4
 None known
resteasy3.0
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.0.26-6
 None known

History

History
RecordedChangedSources
referencesNVD, OSV
products, referencesCVE List
referencesEUVD, OSV
referencesOSV
affected, factsNVD, OSV
products, referencesEUVD
referencesNVD, OSV
products, referencesCVE List, EUVD, NVD
referencesCVE List, OSV
referencesCVE List, NVD
products, referencesEUVD, NVD, OSV
facts, products, referencesCVE List
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-89059 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Apache Camel 3.33.4.redhat, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. No source names a fixed version.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open