CVE-2026-89059 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)
Remote attackers can cause denial of service in applications using RESTEasy by sending crafted images that trigger excessive memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89059?
CVE-2026-89059 is a high-severity denial of service vulnerability in Red Hat Build of Keycloak, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.
Weakness: CWE-409
Which versions are affected by CVE-2026-89059?
How do I fix CVE-2026-89059?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89059 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-89059 exists.
Sources
Also known as CLEANSTART-2026-XI97037, DEBIAN-CVE-2026-89059, GHSA-m4pc-7gc7-9vw2, UBUNTU-CVE-2026-89059.