RESTEasy CVE-2026-89059

Requires that the target application expose a RESTEasy (JAX-RS) endpoint that accepts an image request body deserialized via IIOImageProvider (i.e., a resource method consuming an image content type such as image/*). Given such an endpoint, exploitation is remote and unauthenticated (PR:N/UI:N) against default RESTEasy behavior, since no limit is enforced on declared image dimensions or pixel count. The principal LIMITING factor is reachability: RESTEasy deployments that never consume image bodies through the image provider are not exposed, so the flaw is application-design-dependent rather than universally triggerable across all Red Hat products that ship RESTEasy. Impact is confined to availability (JVM heap exhaustion / DoS); there is no confidentiality or integrity effect.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a cleanly remote, unauthenticated, low-complexity denial-of-service with no confidentiality or integrity impact - availability-only, which is internally consistent with CWE-409 (data amplification / improper handling of highly compressed data). No EPSS score, no CISA KEV entry, and no public POC were supplied, so exploitation status is: no public exploit identified at time of analysis. The realistic risk is moderate rather than critical despite the 7.5: the flaw is trivially reachable in principle (a small crafted image declaring huge dimensions forces a large heap allocation), but it only bites applications whose RESTEasy endpoints actually accept image request bodies routed through IIOImageProvider - a non-default, application-specific code path. This is therefore a genuine but conditional priority: patch promptly on internet-facing services that consume image uploads/bodies, but the raw 7.5 overstates blast radius for the majority of RESTEasy deployments that never invoke the image provider. No signals conflict; the main caveat is that reachability depends on application design rather than a default RESTEasy configuration.

An attacker identifies a public REST endpoint that consumes an image content type (handled by RESTEasy's IIOImageProvider) and POSTs a small, crafted image whose header declares enormous width/height (huge pixel count). RESTEasy attempts to allocate a raster buffer sized to the declared dimensions, exhausting the JVM heap and crashing or hanging the service. No authentication or user interaction is required and no public POC is currently known, though the mechanism is straightforward to reproduce.