CVE-2026-89059Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
- 7.5HighCVSS base score
- 1.5%Exploitation in 30 daysEPSS · top 25% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- YesPublic exploitsa reference or SSVC says so
Description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. 2 references of the record are tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits2
References tagged exploit2 references
- RHBZ#2519756 (opens in a new tab)issue-trackingx_refsource_REDHATexploit
- https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2 (opens in a new tab)exploit
Timeline
ID reserved
By redhat
- 8 days later
· 8 days later
Published
- 54 days later
· 54 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.5% · top 25% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected < 6.2.19.Final
- affected 7.0.0.Alpha1 – < 7.0.5.Final
Red Hat · Red Hat Build of Apache Camel 3.33.4.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat build of Quarkus 3.27.6.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat build of Quarkus 3.33.4.redhat
- unaffected 6.2.19.Final-redhat-00003 – < *
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:11.9.0-6.el10_2.1 – < *
Red Hat · Red Hat Enterprise Linux 10
- unaffected 0:11.9.0-9.el10_3.1 – < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support
- unaffected 0:11.6.0-3.el10_0.2 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:3.0.26-20.el9_8.1 – < *
Red Hat · Red Hat Enterprise Linux 9
- unaffected 0:3.0.26-20.el9_9.1 – < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
- unaffected 0:3.0.26-16.el9_2.1 – < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
- unaffected 0:3.0.26-20.el9_4.2 – < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support
- unaffected 0:3.0.26-20.el9_6.2 – < *
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1
All versions: unaffected
Red Hat · Red Hat JBoss Enterprise Application Platform 8.1
All versions: unaffected
Red Hat · Red Hat build of Apache Camel 4 for Quarkus 3
All versions: affected
Red Hat · Red Hat build of Apicurio Registry 3
All versions: affected
Red Hat · Red Hat build of Debezium 3
All versions: affected
Red Hat · Red Hat Build of Keycloak
All versions: affected
Red Hat · Red Hat Build of Keycloak
All versions: affected
Red Hat · Red Hat Certificate System 10
All versions: affected
Red Hat · Red Hat Certificate System 11
All versions: affected
Red Hat · Red Hat Enterprise Linux 8
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
All versions: affected
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform 7
All versions: affected
Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
All versions: affected
All versions: unaffected
Red Hat · Red Hat Single Sign-On 7
All versions: affected
References
References17
- RHSA-2026:83082 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:83520 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:83670 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:85234 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:92408 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95221 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95466 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95504 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95505 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:95887 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:96077 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:98494 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- RHSA-2026:98606 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-89059 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2519756 (opens in a new tab)issue-trackingx_refsource_REDHATexploit
- https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb (opens in a new tab)
- https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2 (opens in a new tab)exploit
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-82735 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-89059)Record last updated .