Denial of Service Vulnerability in RESTEasy IIOImageProvider Affects Red Hat
CVE-2026-89059

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Build Of Apicurio Registry 3
Red Hat Build Of Debezium 3
Vendor
CVE Published:
18 September 2026

What is CVE-2026-89059?

A flaw in RESTEasy's IIOImageProvider permits remote, unauthenticated attackers to send specially crafted image requests, bypassing limits on declared dimensions and pixel counts. This can result in excessive memory allocation within the JVM, potentially leading to a denial of service as the JVM heap becomes exhausted.

References

https://access.redhat.com/security/cve/CVE-2026-89059
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2519756
issue-trackingx_refsource_REDHAT
https://github.com/resteasy/resteasy/security/advisories/...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Yu Bao (PayPal Cyber Security Team) for reporting this issue.
.