High severity7.5NVD Advisory· Published Sep 18, 2026· Updated Oct 29, 2026
CVE-2026-89059
CVE-2026-89059
Description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14- osv-coords12 versionspkg:rpm/almalinux/idm-pki-acmepkg:rpm/almalinux/idm-pki-basepkg:rpm/almalinux/idm-pki-capkg:rpm/almalinux/idm-pki-javapkg:rpm/almalinux/idm-pki-krapkg:rpm/almalinux/idm-pki-serverpkg:rpm/almalinux/pki-resteasy-corepkg:rpm/almalinux/pki-resteasy-jackson2-providerpkg:rpm/almalinux/pki-resteasy-servlet-initializerpkg:rpm/almalinux/idm-pki-toolspkg:rpm/almalinux/pki-resteasy-clientpkg:rpm/almalinux/python3-idm-pki
< 11.9.0-6.el10_2.1.alma.1+ 11 more
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
- (no CPE)range: < 3.0.26-20.el9_8.1
- (no CPE)range: < 11.9.0-6.el10_2.1.alma.1
Patches
Vulnerability mechanics
References
8- access.redhat.com/errata/RHSA-2026:83082nvd
- access.redhat.com/errata/RHSA-2026:83520nvd
- access.redhat.com/errata/RHSA-2026:85234nvd
- access.redhat.com/errata/RHSA-2026:92408nvd
- access.redhat.com/security/cve/CVE-2026-89059nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacbnvd
- github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2nvd
News mentions
0No linked articles in our index yet.