# CVE-2026-16308: IBM Enterprise Build of Quarkus denial of service in Quarkus REST

Source: https://junglewise.ai/threats/cve-2026-16308-ibm-enterprise-build-of-quarkus-denial-of-service-in-quarkus-rest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-16308 · Severity: high · CVSS 7.5 · Published 2026-07-30

IBM Enterprise Build of Quarkus, a framework used for developing Java applications, is vulnerable to a denial-of-service attack. A remote attacker can send specially crafted web requests that cause the application to consume excessive memory, potentially leading to a complete system crash or service unavailability. This could disrupt business operations and impact the availability of customer-facing applications.

Technologies: [IBM Enterprise Build of Quarkus](https://junglewise.ai/threats/technologies/enterprise-build-of-quarkus). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-16308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16308 being exploited in the wild.

**How severe is CVE-2026-16308?** High severity, with a CVSS score of 7.5, published 30 July 2026.

**Which products and versions are affected?** IBM Enterprise Build of Quarkus 3.27.1 - 3.27.4.SP2, 3.33.1 - 3.33.2.SP2.

**Is there a fix for CVE-2026-16308?** A patch was published on 2026-07-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16308 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16308?** Check whether you run IBM Enterprise Build of Quarkus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in the Quarkus REST component of IBM Enterprise Build of Quarkus. The flaw is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling) and stems from the unbounded accumulation of multipart MIME part-header bytes. A remote, unauthenticated attacker can exploit this by sending a malicious multipart request with excessively large or numerous headers, leading to memory exhaustion. The vulnerability is addressed in versions 3.27.4.SP3 and 3.33.2.SP3.

## Affected products

- IBM Enterprise Build of Quarkus 3.27.1 - 3.27.4.SP2, 3.33.1 - 3.33.2.SP2

## Timeline

- 2026-07-30: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched

## References

- [https://www.ibm.com/support/pages/node/7281904](https://www.ibm.com/support/pages/node/7281904)

## Related threats

- [IBM Enterprise Build of Quarkus SQL injection in Hibernate](https://junglewise.ai/threats/cve-2026-77874-ibm-enterprise-build-of-quarkus-3-27-1-through-3-27-5-sp1-and-3)
- [IBM Enterprise Build of Quarkus authorization bypass in Spring Web](https://junglewise.ai/threats/cve-2026-19651-ibm-enterprise-build-of-quarkus-authorization-bypass-in-spring)
- [Quarkus OIDC token introspection cache authorization bypass](https://junglewise.ai/threats/cve-2026-19625-quarkus-oidc-token-introspection-cache-authorization-bypass)