RESTEasy IIOImageProv Unbounded Image Dimension DoS
CVE-2026-89059 Published on September 18, 2026

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

A proof of concept, or POC exists for this vulnerability which can be automated.

Vulnerability Analysis

CVE-2026-89059 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Exploitation:
POC
Automatable:
YES
Technical Impact:
PARTIAL
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 29 days later.

Weakness Type

What is a Data Amplification Vulnerability?

The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

CVE-2026-89059 has been classified to as a Data Amplification vulnerability or weakness.


Products Associated with CVE-2026-89059

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Camel Quarkus
Red Hat Apicurio Registry
Red Hat Debezium
Red Hat Build Keycloak
Red Hat Quarkus
Red Hat Certificate System
Red Hat Enterprise Linux (RHEL)
Red Hat Jboss Fuse
Red Hat Jboss Enterprise Application Platform
Red Hat Jbosseapxp
Red Hat Satellite
Red Hat Single Sign On
Red Hat Jboss Enterprise Application Platform Xp
Red Hat Enterprise Linux Eus
Red Hat Rhel E4s
Red Hat Rhel Eus
Red Hat Apache Camel Quarkus

Affected Versions

Red Hat RESTEasy: Red Hat Build of Apache Camel 3.33.4.redhat: Red Hat build of Quarkus 3.27.6.redhat: Red Hat build of Quarkus 3.33.4.redhat: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat JBoss Enterprise Application Platform 8.1: Red Hat build of Apache Camel 4 for Quarkus 3: Red Hat build of Apicurio Registry 3: Red Hat build of Debezium 3: Red Hat Build of Keycloak: Red Hat Build of Keycloak: Red Hat Certificate System 10: Red Hat Certificate System 11: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat Satellite 6: Red Hat Single Sign-On 7: