CVE-2024-1726 Quarkus: security checks in resteasy reactive may trigger a denial of service
Attackers can cause denial of service in Quarkus RESTEasy Reactive by triggering resource exhaustion on inherited endpoints due to delayed security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-1726?
CVE-2024-1726 is a medium-severity denial of service vulnerability in Red Hat build of Quarkus, published on 25 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
Weakness: CWE-281
Which versions are affected by CVE-2024-1726?
6 open source packages ship an affected version, including io.quarkus.resteasy.reactive:resteasy-reactive.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkus.resteasy.reactive:resteasy-reactive Maven | All versions | 3.2.11.Final |
io.quarkus.resteasy.reactive:resteasy-reactive Maven | All versions | 3.2.11.Final |
io.quarkus.resteasy.reactive:resteasy-reactive Maven | From 3.3.0.CR1 | 3.7.4 |
io.quarkus.resteasy.reactive:resteasy-reactive Maven | From 3.3.0.CR1 | 3.7.4 |
io.quarkus.resteasy.reactive:resteasy-reactive Maven | From 3.8.0.CR1 | 3.8.0 |
io.quarkus.resteasy.reactive:resteasy-reactive Maven | From 3.8.0.CR1 | 3.8.0 |
How do I fix CVE-2024-1726?
Upgrade io.quarkus.resteasy.reactive:resteasy-reactive to a fixed version for your release line: 3.2.11.Final, 3.7.4 or 3.8.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-1726 being exploited?
There is no known exploitation of CVE-2024-1726 in the wild and no public exploit code.
Sources
Also known as GHSA-mv64-86g8-cqq7.