What is the CVSS score of EUVD-2026-51135?

EUVD-2026-51135 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Enterprise Build of Quarkus are affected by EUVD-2026-51135?

Organizations running IBM Enterprise Build of Quarkus versions 3.27.1-3.27.4.SP2 or 3.33.1-3.33.2.SP2 are at immediate risk of service disruption from external attackers who need no special access or…. A patch is available.

How to fix or mitigate EUVD-2026-51135?

Within 24 hours, identify all applications and services running IBM Enterprise Build of Quarkus versions 3.27.1-3.27.4.SP2 or 3.33.1-3.33.2.SP2 across your infrastructure. Within 7 days, apply vendor patches to upgrade affected instances to versions beyond 3.27.4.SP2 and 3.33.2.SP2 respectively, prioritizing production systems. Within 30 days, validate complete patch deployment in all production and staging environments, review historical logs for suspicious multipart request patterns, and implement network-level rate limiting on multipart endpoints as a defense-in-depth control.

Enterprise Build of Quarkus EUVD-2026-51135

| CVE-2026-16308 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-30 ibm

GHSA-g8rv-gp9f-q875

Denial Of Service IBM Red Hat Enterprise Build Of Quarkus

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated multipart request triggers unbounded allocation, so AV:N/AC:L/PR:N/UI:N with A:H and no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:24 vuln.today

CVE Published

Jul 30, 2026 - 14:04 nvd

HIGH 7.5

DescriptionCVE.org

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.

AnalysisAI

Denial of service in IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2) allows a remote, unauthenticated attacker to exhaust memory by sending multipart requests whose MIME part-headers are accumulated without bound in the Quarkus REST layer. Because each part-header buffer grows without a size cap, an attacker can force excessive heap allocation and crash or hang the service, degrading availability for all users. There is no public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N/UI:N) against any endpoint that accepts multipart input.

Technical ContextAI

The affected component is Quarkus REST (the Jakarta REST / RESTEasy Reactive stack in the Quarkus framework), specifically its handling of multipart/form-data or multipart MIME bodies. When parsing a multipart message, each part is preceded by header lines (e.g. Content-Disposition, Content-Type). The parser accumulates these part-header bytes into a buffer while scanning for the header terminator, but does not enforce an upper bound on how many bytes it will buffer. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling): a client-controlled input drives an unbounded server-side allocation. The CPE cpe:2.3:a:ibm:enterprise_build_of_quarkus:*:*:*:*:*:*:*:* identifies IBM's supported/hardened distribution of the upstream Quarkus project as the affected product; the underlying parsing logic derives from the open-source Quarkus REST components.

RemediationAI

Patch available per vendor advisory - IBM has released a fix for the Enterprise Build of Quarkus, documented at https://www.ibm.com/support/pages/node/7281904; upgrade to the IBM-designated fixed version beyond 3.27.4.SP2 (for the 3.27 line) and beyond 3.33.2.SP2 (for the 3.33 line) as specified in that advisory. Because the exact patched build identifiers are not enumerated in the available intelligence, obtain the precise fix version directly from the IBM support page before deploying. As a compensating control until patching, place a size limit on request bodies and headers at an upstream reverse proxy or API gateway (for example, cap the multipart body and per-part header size) so oversized multipart part-headers are rejected before reaching the application - the trade-off is that legitimately large uploads may be blocked, so set the limit above real business needs. Where feasible, disable or restrict access to multipart-accepting endpoints that are not required, and require authentication on those endpoints to shrink the unauthenticated attack surface; note this does not fix the underlying unbounded allocation and only reduces exposure.