Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Historical advisory recorded 11 Nov 2026 13:57:25 UTC. Read the latest advisory.

cve-program · CVE-2026-89059

Published

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89059

Published

RESTEasy

https://github.com/resteasy/resteasy

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "6.2.19.Final",
                            "versionType": "maven"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.0.Alpha1",
                            "lessThan": "7.0.5.Final",
                            "versionType": "maven"
                        }
                    ],
                    "packageName": "RESTEasy",
                    "collectionURL": "https://github.com/resteasy/resteasy",
                    "defaultStatus": "unaffected"
                }

org.jboss.resteasy/resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Apache Camel 3.33.4.redhat",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "org.jboss.resteasy/resteasy-core",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "6.2.19.Final-redhat-00003",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:apache_camel_quarkus:3.33"
                    ]
                }

org.jboss.resteasy/resteasy-core

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Quarkus 3.27.6.redhat",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "org.jboss.resteasy/resteasy-core",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "6.2.19.Final-redhat-00003",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:quarkus:3.27::el8"
                    ]
                }

org.jboss.resteasy/resteasy-core

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Quarkus 3.33.4.redhat",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "org.jboss.resteasy/resteasy-core",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "6.2.19.Final-redhat-00003",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:quarkus:3.33::el8"
                    ]
                }

dogtag-pki

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "dogtag-pki",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:11.9.0-6.el10_2.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10.2"
                    ]
                }

dogtag-pki

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "dogtag-pki",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:11.9.0-9.el10_3.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10.3"
                    ]
                }

dogtag-pki

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "dogtag-pki",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:11.6.0-3.el10_0.2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux_eus:10.0"
                    ]
                }

resteasy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:3.0.26-20.el9_8.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9::appstream"
                    ]
                }

resteasy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:3.0.26-20.el9_9.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9::appstream"
                    ]
                }

resteasy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:3.0.26-16.el9_2.1",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_e4s:9.2::appstream"
                    ]
                }

resteasy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:3.0.26-20.el9_4.2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_e4s:9.4::appstream"
                    ]
                }

resteasy

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:3.0.26-20.el9_6.2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:rhel_eus:9.6::appstream"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 8.1",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "unaffected",
                    "packageName": "resteasy-core",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:8.1"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 8.1",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "defaultStatus": "unaffected",
                    "packageName": "resteasy-core",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:camel_quarkus:3"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apicurio Registry 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:apicurio_registry:3"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Debezium 3",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:debezium:3"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Keycloak",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:"
                    ]
                }

rhbk/keycloak-rhel9-operator

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Keycloak",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhbk/keycloak-rhel9-operator",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:"
                    ]
                }

redhat-pki:10/redhat-pki

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Certificate System 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-pki:10/redhat-pki",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:certificate_system:10"
                    ]
                }

redhat-pki

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Certificate System 11",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "redhat-pki",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:certificate_system:11"
                    ]
                }

pki-core:10.6/pki-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 8",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "pki-core:10.6/pki-core",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:8"
                    ]
                }

jackson-jaxrs-providers

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "jackson-jaxrs-providers",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

pki-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "pki-core",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9"
                    ]
                }

resteasy-core

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Fuse 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_fuse:7"
                    ]
                }

resteasy-jaxrs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Fuse 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-jaxrs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_fuse:7"
                    ]
                }

jboss-eap-7/eap74-els-openjdk11-openshift-rhel8

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

jboss-eap-7/eap74-els-openjdk17-openshift-rhel8

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

jboss-eap-7/eap74-els-openjdk8-openshift-rhel8

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

resteasy-jaxrs

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "resteasy-jaxrs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

resteasy-core

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "resteasy-core",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:jbosseapxp"
                    ]
                }

candlepin

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Satellite 6",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "candlepin",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:satellite:6"
                    ]
                }

resteasy-jaxrs

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Single Sign-On 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "resteasy-jaxrs",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:red_hat_single_sign_on:7"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 12 Nov 18:36 UTC · 273 of 275 readable · 271 fully read · documentation 469/469 current