Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
Impact
A flaw in RESTEasy's IIOImageProvider can cause a denial of service. Affected versions include RESTEasy less than 6.2.19.Final and 7.0.0.Alpha1 less than 7.0.5.Final. A remote, unauthenticated attacker can trigger a large memory allocation.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Red Hat · redhat
RESTEasy
2 ranges
Red Hat · redhat
RESTEasy
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 6.2.19.Final
maven versions
7.0.0.Alpha1 → before 7.0.5.Final
maven versions
Other versions: unaffected
Red Hat · redhat
Red Hat build of Quarkus 3.27.6.redhat
1 range
Red Hat · redhat
Red Hat build of Quarkus 3.27.6.redhat
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
6.2.19.Final-redhat-00003 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:quarkus:3.27::el8Red Hat · redhat
Red Hat build of Quarkus 3.33.4.redhat
1 range
Red Hat · redhat
Red Hat build of Quarkus 3.33.4.redhat
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
6.2.19.Final-redhat-00003 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:quarkus:3.33::el8Red Hat · redhat
Red Hat Enterprise Linux 10
1 range
Red Hat · redhat
Red Hat Enterprise Linux 10
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:11.9.0-6.el10_2.1 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:10.2Red Hat · redhat
Red Hat Enterprise Linux 9
1 range
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:3.0.26-20.el9_8.1 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:enterprise_linux:9::appstreamRed Hat · redhat
Red Hat build of Apache Camel 4 for Quarkus 3
0 ranges
Red Hat · redhat
Red Hat build of Apache Camel 4 for Quarkus 3
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:camel_quarkus:3Red Hat · redhat
Red Hat build of Apicurio Registry 3
0 ranges
Red Hat · redhat
Red Hat build of Apicurio Registry 3
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:apicurio_registry:3Red Hat · redhat
Red Hat build of Debezium 3
0 ranges
Red Hat · redhat
Red Hat build of Debezium 3
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:debezium:3Red Hat · redhat
Red Hat Build of Keycloak
0 ranges
Red Hat · redhat
Red Hat Build of Keycloak
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:build_keycloak:Red Hat · redhat
Red Hat Build of Keycloak
0 ranges
Red Hat · redhat
Red Hat Build of Keycloak
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:build_keycloak:Red Hat · redhat
Red Hat Certificate System 10
0 ranges
Red Hat · redhat
Red Hat Certificate System 10
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:certificate_system:10Red Hat · redhat
Red Hat Certificate System 11
0 ranges
Red Hat · redhat
Red Hat Certificate System 11
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:certificate_system:11Red Hat · redhat
Red Hat Enterprise Linux 8
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 8
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:8Red Hat · redhat
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Red Hat · redhat
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Red Hat · redhat
Red Hat Fuse 7
0 ranges
Red Hat · redhat
Red Hat Fuse 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_fuse:7Red Hat · redhat
Red Hat Fuse 7
0 ranges
Red Hat · redhat
Red Hat Fuse 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_fuse:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:7Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 8
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform 8
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jboss_enterprise_application_platform:8Red Hat · redhat
Red Hat JBoss Enterprise Application Platform Expansion Pack
0 ranges
Red Hat · redhat
Red Hat JBoss Enterprise Application Platform Expansion Pack
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:jbosseapxpRed Hat · redhat
Red Hat Satellite 6
0 ranges
Red Hat · redhat
Red Hat Satellite 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/a:redhat:satellite:6Red Hat · redhat
Red Hat Single Sign-On 7
0 ranges
Red Hat · redhat
Red Hat Single Sign-On 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:red_hat_single_sign_on:7Original source description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-89059View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.