Vulnerability details
CVE-2026-89059
Red Hat Build of KeycloakRed Hat Certificate System 10Red Hat Certificate System 11Red Hat Fuse 7Red Hat JBoss Enterprise Application Platform 7Red Hat JBoss Enterprise Application Platform Expansion Pack
Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
CVSS 3.1
7.5High
Official description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Certificate System 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Certificate System 11 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | — | v < 6.2.19.Final | CVEProject cvelistV5 (CNA) |
| Red Hat | — | 7.0.0.Alpha1 ≤ v < 7.0.5.Final | CVEProject cvelistV5 (CNA) |
References and advisories
15- https://access.redhat.com/errata/RHSA-2026:83082 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:83520 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:83670 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:85234 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:92408 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95221 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95466 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95504 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95505 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95887 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:96077 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-89059 vdb-entryx_refsource_REDHAT
- https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb
- https://bugzilla.redhat.com/show_bug.cgi?id=2519756 issue-trackingx_refsource_REDHAT
- https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-18
- Last updated
- 2026-11-09
- State
- Published
- Assigner (CNA)
- redhat
Exploit prediction (EPSS)
1.53%
Probability of exploitation in 30 days
74.8%
Percentile (among all CVEs)
- 2026-11-061.53%
- 2026-11-030.89%
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)