CVE-2026-89059

Name of the Vulnerable Software and Affected Versions RESTEasy (affected versions not specified)

Description A flaw exists in the IIOImageProvider component that decodes image request bodies without enforcing limits on declared image dimensions or pixel counts. A remote, unauthenticated attacker can send a small, crafted image with enormous declared dimensions to trigger a massive memory allocation. This process exhausts the JVM heap, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.