Executive brief
RESTEasy is a Java framework used to build web services. A flaw in its image handling component allows attackers to send specially crafted image files that declare extremely large dimensions, causing the server to allocate massive amounts of memory and crash. An attacker can exploit this remotely without authentication, disrupting service availability for all users.
Technical details
The vulnerability is a denial of service flaw in RESTEasy's IIOImageProvider component, which processes image data from HTTP request bodies. The root cause is insufficient validation of image dimensions and pixel counts declared in attacker-supplied image payloads. A remote, unauthenticated attacker can craft a small image file with falsely declared enormous dimensions to trigger excessive heap allocation, exhausting JVM memory and causing a denial of service. The attack requires only network reachability to an exposed RESTEasy image endpoint; no authentication is needed. Patches should be available from the vendor.
Affected products
- Red Hat RESTEasy unknown
Timeline
- 2026-09-18: disclosed: CVE-2026-89059 published