CVE-2026-89059

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

This vulnerability is rated as Important severity because an unauthenticated remote caller can trigger complete service disruption across affected Java virtual machines with minimal network traffic. While RESTEasy is widely integrated into Red Hat enterprise runtimes, exploitation is restricted to application endpoints explicitly configured to ingest image MIME types using the Java Image I/O provider. Deployments that do not expose REST endpoints binding IIOImage or handling arbitrary image uploads are not susceptible to this denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.