Quarkus REST Denial of Service Vulnerability in IBM Enterprise Build
CVE-2026-16308

7.5HIGH

Key Information:

Vendor

IBM
Status
Enterprise Build Of Quarkus
Vendor
CVE Published:
30 July 2026

What is CVE-2026-16308?

An unbounded accumulation of multipart MIME part-header bytes in IBM's Enterprise Build of Quarkus versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2 could allow remote attackers to induce a denial of service. This vulnerability arises from improper handling of multipart requests, which can lead to excessive resource consumption and potentially disrupt the service.

Affected Version(s)

Enterprise Build of Quarkus 3.27.1 <= 3.27.4.SP2

Enterprise Build of Quarkus 3.33.1 <= 3.33.2.SP2

References

https://www.ibm.com/support/pages/node/7281904
vendor-advisorypatch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mike Read (JP Morgan)
.