boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-89059

CVE-2026-89059HIGH
Red Hat RESTEasy — Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0085   57.3     —
AFFECTED
  Product                                        Versions     Fixed
  RESTEasy                                       unspecified  —
  Red Hat build of Quarkus 3.27.6.redhat         unspecified  6.2.19.Final-redhat-00003
  Red Hat build of Quarkus 3.33.4.redhat         unspecified  6.2.19.Final-redhat-00003
  Red Hat build of Apache Camel 4 for Quarkus 3  unspecified  —
  Red Hat build of Apicurio Registry 3           unspecified  —
  Red Hat build of Debezium 3                    unspecified  —
  Red Hat Build of Keycloak                      unspecified  —
  Red Hat Build of Keycloak                      unspecified  —
  Red Hat Certificate System 10                  unspecified  —
  Red Hat Certificate System 11                  unspecified  —
  + 15 more
TIMELINE
  Sep 10  Reserved by redhat
  Sep 18  Published (CNA: redhat)
  Oct 15  PATCH SHIPPED — CVE-2026-89059 (Red Hat RESTEasy). Fixed in Red Hat build of Quarkus 3.27.6.redhat 6.2.19.Final-redhat-00003.
CWE-409 · CNA: redhat · CVSS v3.1 · 6 references · NVD status: Awaiting Analysis

Description

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
September 10, 2026ReservedReserved by redhat
September 18, 2026PublishedPublished (CNA: redhat)
October 15, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-89059 (Red Hat RESTEasy). Fixed in Red Hat build of Quarkus 3.27.6.redhat 6.2.19.Final-redhat-00003.

Affected

Affected products and packages — 25 rows
VendorProduct / PackageEcosystemVersion introducedFixed
Red HatRESTEasy———
Red HatRed Hat build of Quarkus 3.27.6.redhat——6.2.19.Final-redhat-00003
Red HatRed Hat build of Quarkus 3.33.4.redhat——6.2.19.Final-redhat-00003
Red HatRed Hat build of Apache Camel 4 for Quarkus 3———
Red HatRed Hat build of Apicurio Registry 3———
Red HatRed Hat build of Debezium 3———
Red HatRed Hat Build of Keycloak———
Red HatRed Hat Build of Keycloak———
Red HatRed Hat Certificate System 10———
Red HatRed Hat Certificate System 11———
Red HatRed Hat Enterprise Linux 10———
Red HatRed Hat Enterprise Linux 8———
Red HatRed Hat Enterprise Linux 9———
Red HatRed Hat Enterprise Linux 9———
Red HatRed Hat Enterprise Linux 9———
Red HatRed Hat Fuse 7———
Red HatRed Hat Fuse 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 7———
Red HatRed Hat JBoss Enterprise Application Platform 8———
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack———
Red HatRed Hat Satellite 6———
Red HatRed Hat Single Sign-On 7———

Weaknesses

CWE-409

References (6)

Related

Authoritative record: CVE-2026-89059 at cve.org

Vendors: red hat

Weaknesses: CWE-409

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-89059 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.