A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
References
Configurations
No configuration.
History
29 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Oct 2026, 00:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Oct 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Sep 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2519756 - | |
| References | () https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2 - |
18 Sep 2026, 13:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Sep 2026, 08:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-18 08:17
Updated : 2026-10-29 20:17
NVD link : CVE-2026-89059
Mitre link : CVE-2026-89059
CVE.ORG link : CVE-2026-89059
JSON object : View
Products Affected
No product.
CWE
CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)