{"id":"CVE-2026-89059","aliases":["ALSA-2026:85234","ALSA-2026:92408","DEBIAN-CVE-2026-89059","EUVD-2026-82735","GHSA-m4pc-7gc7-9vw2","RHSA-2026:85234","RLSA-2026:85234","RLSA-2026:92408","UBUNTU-CVE-2026-89059"],"status":"published","title":"Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0153,"percentile":0.74932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-409"],"published":"2026-09-18T07:13:39Z","modified":"2026-11-09T10:45:48Z","affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-resteasy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-resteasy-jackson2-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pki-resteasy-servlet-initializer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-acme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-ca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-kra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"idm-pki-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-idm-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-6.el10_2.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Debian:13","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Debian:14","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-resteasy-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-resteasy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-resteasy-jackson2-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pki-resteasy-servlet-initializer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.26-20.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"dogtag-pki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.9.0-6.el10_2.1.rocky.0.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6-3","3.0.6-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.19-1","3.0.19-2","3.0.26-1~18.04","3.0.26-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-2","3.6.2-2ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-1","3.0.26-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-2","3.0.26-3","3.0.26-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-2","3.6.2-2ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6","3.0.26-6ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-2","3.6.2-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"resteasy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-3","3.6.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"resteasy3.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.26-6"]}],"products":[{"vendor":"red hat","product":"red hat build of apache camel 3.33.4.redhat"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.6.redhat"},{"vendor":"red hat","product":"red hat build of quarkus 3.33.4.redhat"},{"vendor":"red hat","product":"red hat certificate system 10"},{"vendor":"red hat","product":"red hat certificate system 11"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat single sign-on 7"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:83082","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83670","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85234","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92408","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95221","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95466","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95504","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95505","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:95887","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96077","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89059","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519756","tags":["issue-tracking","x_refsource_REDHAT","exploit","report"]},{"url":"https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb","tags":["fix","article","report"]},{"url":"https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2","tags":["exploit","advisory","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89058","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519756","tags":["report"]},{"url":"https://bugzilla.redhat.com/2519775","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-85234.html","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-89407","tags":["report"]},{"url":"https://bugzilla.redhat.com/2538720","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-92408.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89059.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89059","tags":["advisory"]},{"url":"https://github.com/resteasy/resteasy","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-89059","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519775","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85234.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89058","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89058","tags":["advisory"]},{"url":"https://github.com/resteasy/resteasy/commit/efeb2b7","tags":["article"]},{"url":"https://github.com/resteasy/resteasy/security/advisories/GHSA-972r-f3fv-whm3","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89059","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85234","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92408","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538720","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-89059","tags":["report"]},{"url":"https://redhat.atlassian.net/browse/RESTEASY-3793","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-89059","title":"Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","status":"published","published":"2026-09-18T07:13:39.763Z","modified":"2026-11-09T01:47:30.044Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-409"],"updated_at":"2026-11-09T02:45:30.471959Z"}],"euvd":[{"id":"EUVD-2026-82735","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","status":"published","published":"2026-09-18T07:13:39Z","modified":"2026-11-09T01:47:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T03:14:57.152663Z"}],"nvd":[{"id":"CVE-2026-89059","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","status":"published","published":"2026-09-18T08:17:01.783Z","modified":"2026-11-09T02:17:00.21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-409"],"updated_at":"2026-11-09T07:12:48.496067Z"}],"osv":[{"id":"CVE-2026-89059","title":"Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","status":"published","published":"2026-09-18T07:13:39.763Z","modified":"2026-11-10T02:45:39.02458525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-409"],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"DEBIAN-CVE-2026-89059","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","status":"published","published":"2026-09-18T08:17:01.783Z","modified":"2026-11-09T09:47:30.242720999Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"RHSA-2026:85234","title":"Red Hat Security Advisory: resteasy security update","status":"published","published":"2026-10-20T10:18:01Z","modified":"2026-10-20T10:32:24.539203003Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:85234","title":"Important: resteasy security update","description":"RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.\n\nSecurity Fix(es):\n\n* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)\n\n* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:05:07.452289Z","modified":"2026-10-20T12:15:37.989636029Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92408","title":"Important: dogtag-pki security update","description":"IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments.  IdM PKI consists of the following components: \n  * Certificate Authority (CA)\n  * Key Recovery Authority (KRA)\n  * Online Certificate Status Protocol (OCSP) Manager\n  * Token Key Service (TKS)\n  * Token Processing Service (TPS)\n  * Automatic Certificate Management Environment (ACME) Responder\n  * Enrollment over Secure Transport (EST) Responder\n\nSecurity Fix(es):\n\n* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)\n\n* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)\n\n* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:08:48.996475Z","modified":"2026-10-30T12:30:03.150634574Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-89059","description":"A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.","status":"published","published":"2026-09-18T08:17:00Z","modified":"2026-10-17T13:01:16.363384906Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:85234","title":"Important: resteasy security update","description":"RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.  \n\nSecurity Fix(es):  \n\n  * resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)\n  * resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.368209591Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:92408","title":"Important: dogtag-pki security update","description":"IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:   \n\n  * Certificate Authority (CA)\n  * Key Recovery Authority (KRA)\n  * Online Certificate Status Protocol (OCSP) Manager\n  * Token Key Service (TKS)\n  * Token Processing Service (TPS)\n  * Automatic Certificate Management Environment (ACME) Responder\n  * Enrollment over Secure Transport (EST) Responder\n\n\nSecurity Fix(es):  \n\n  * resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)\n  * resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)\n  * com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-30T13:30:02.411311043Z","updated_at":"2026-11-02T15:27:57.367731Z"}]}}