{
  "cve": "CVE-2026-89059",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 86.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 86.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "build_of_apache_camel_for_quarkus",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 86.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 86.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat build of Apicurio Registry 3",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "build_of_apicurio_registry",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 85.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 85.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat build of Debezium 3",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "build_of_debezium_3",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "manual",
          "scores": [
            {
              "score": 100.0,
              "source": "manual"
            }
          ]
        },
        "original": {
          "product": "Red Hat Build of Keycloak",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "build_of_keycloak",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 84.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 84.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat build of Quarkus",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "build_of_quarkus",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 81.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 81.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat Certificate System 10",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "dogtag_certificate_system",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "manual",
          "scores": [
            {
              "score": 100.0,
              "source": "manual"
            }
          ]
        },
        "original": {
          "product": "Red Hat Enterprise Linux 10",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "enterprise_linux",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 89.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 89.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat JBoss Enterprise Application Platform 7",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "jboss_enterprise_application_platform",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 93.0,
          "confidence_source": "matching",
          "scores": [
            {
              "score": 93.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "jboss_enterprise_application_platform_expansion_pack",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "manual",
          "scores": [
            {
              "score": 100.0,
              "source": "manual"
            }
          ]
        },
        "original": {
          "product": "Red Hat Fuse 7",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "quay_3",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "manual",
          "scores": [
            {
              "score": 100.0,
              "source": "manual"
            }
          ]
        },
        "original": {
          "product": "Red Hat Satellite 6",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "satellite_6",
        "vendor": "redhat"
      },
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 100.0,
          "confidence_source": "manual",
          "scores": [
            {
              "score": 100.0,
              "source": "manual"
            }
          ]
        },
        "original": {
          "product": "Red Hat Single Sign-On 7",
          "source": "cna",
          "vendor": "Red Hat"
        },
        "product": "single_sign-on",
        "vendor": "redhat"
      }
    ],
    "created": "2026-09-18T22:15:13.909630+00:00",
    "updated": "2026-09-21T19:26:02.417602+00:00",
    "vendors": [
      "redhat",
      "redhat$PRODUCT$build_of_apache_camel_for_quarkus",
      "redhat$PRODUCT$build_of_apicurio_registry",
      "redhat$PRODUCT$build_of_debezium_3",
      "redhat$PRODUCT$build_of_keycloak",
      "redhat$PRODUCT$build_of_quarkus",
      "redhat$PRODUCT$dogtag_certificate_system",
      "redhat$PRODUCT$enterprise_linux",
      "redhat$PRODUCT$jboss_enterprise_application_platform",
      "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack",
      "redhat$PRODUCT$quay_3",
      "redhat$PRODUCT$satellite_6",
      "redhat$PRODUCT$single_sign-on"
    ]
  },
  "epss": {
    "score": 0.00892
  },
  "mitre": {
    "cpes": [
      "cpe:/a:redhat:apicurio_registry:3",
      "cpe:/a:redhat:build_keycloak:",
      "cpe:/a:redhat:camel_quarkus:3",
      "cpe:/a:redhat:certificate_system:10",
      "cpe:/a:redhat:certificate_system:11",
      "cpe:/a:redhat:debezium:3",
      "cpe:/a:redhat:enterprise_linux:8",
      "cpe:/a:redhat:enterprise_linux:9",
      "cpe:/a:redhat:enterprise_linux:9::appstream",
      "cpe:/a:redhat:jboss_enterprise_application_platform:7",
      "cpe:/a:redhat:jboss_enterprise_application_platform:8",
      "cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0",
      "cpe:/a:redhat:jboss_fuse:7",
      "cpe:/a:redhat:jbosseapxp",
      "cpe:/a:redhat:quarkus:3.27::el8",
      "cpe:/a:redhat:quarkus:3.33::el8",
      "cpe:/a:redhat:red_hat_single_sign_on:7",
      "cpe:/a:redhat:rhel_e4s:9.4::appstream",
      "cpe:/a:redhat:satellite:6",
      "cpe:/o:redhat:enterprise_linux:10.2",
      "cpe:/o:redhat:enterprise_linux_eus:10.0"
    ],
    "created": "2026-09-18T07:13:39.763000+00:00",
    "description": "A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/89xxx/CVE-2026-89059.json",
    "references": [
      "https://access.redhat.com/errata/RHSA-2026:83082",
      "https://access.redhat.com/errata/RHSA-2026:83520",
      "https://access.redhat.com/errata/RHSA-2026:85234",
      "https://access.redhat.com/errata/RHSA-2026:92408",
      "https://access.redhat.com/errata/RHSA-2026:95221",
      "https://access.redhat.com/errata/RHSA-2026:95466",
      "https://access.redhat.com/errata/RHSA-2026:95505",
      "https://access.redhat.com/security/cve/CVE-2026-89059",
      "https://bugzilla.redhat.com/show_bug.cgi?id=2519756",
      "https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb",
      "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2"
    ],
    "title": "Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)",
    "updated": "2026-11-05T12:04:16.323000+00:00",
    "vendors": [
      "redhat",
      "redhat$PRODUCT$apicurio_registry",
      "redhat$PRODUCT$build_keycloak",
      "redhat$PRODUCT$camel_quarkus",
      "redhat$PRODUCT$certificate_system",
      "redhat$PRODUCT$debezium",
      "redhat$PRODUCT$enterprise_linux",
      "redhat$PRODUCT$enterprise_linux_eus",
      "redhat$PRODUCT$jboss_enterprise_application_platform",
      "redhat$PRODUCT$jboss_enterprise_application_platform_xp",
      "redhat$PRODUCT$jboss_fuse",
      "redhat$PRODUCT$jbosseapxp",
      "redhat$PRODUCT$quarkus",
      "redhat$PRODUCT$red_hat_single_sign_on",
      "redhat$PRODUCT$rhel_e4s",
      "redhat$PRODUCT$satellite"
    ],
    "weaknesses": [
      "CWE-409"
    ]
  },
  "nvd": {
    "cpes": [],
    "created": "2026-09-18T08:17:01.783000+00:00",
    "description": "A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-89059.json",
    "references": [
      "https://access.redhat.com/errata/RHSA-2026:83082",
      "https://access.redhat.com/errata/RHSA-2026:83520",
      "https://access.redhat.com/errata/RHSA-2026:85234",
      "https://access.redhat.com/errata/RHSA-2026:92408",
      "https://access.redhat.com/errata/RHSA-2026:95221",
      "https://access.redhat.com/errata/RHSA-2026:95466",
      "https://access.redhat.com/errata/RHSA-2026:95505",
      "https://access.redhat.com/security/cve/CVE-2026-89059",
      "https://bugzilla.redhat.com/show_bug.cgi?id=2519756",
      "https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb",
      "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2"
    ],
    "title": null,
    "updated": "2026-11-05T13:17:08.167000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-409"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-09-18T07:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)",
              "old": null
            },
            "type": "title"
          },
          {
            "details": [
              "redhat",
              "redhat$PRODUCT$apicurio_registry",
              "redhat$PRODUCT$build_keycloak",
              "redhat$PRODUCT$camel_quarkus",
              "redhat$PRODUCT$certificate_system",
              "redhat$PRODUCT$debezium",
              "redhat$PRODUCT$enterprise_linux",
              "redhat$PRODUCT$jboss_enterprise_application_platform",
              "redhat$PRODUCT$jboss_fuse",
              "redhat$PRODUCT$jbosseapxp",
              "redhat$PRODUCT$quarkus",
              "redhat$PRODUCT$red_hat_single_sign_on",
              "redhat$PRODUCT$satellite"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "CWE-409"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "cpe:/a:redhat:apicurio_registry:3",
                "cpe:/a:redhat:build_keycloak:",
                "cpe:/a:redhat:camel_quarkus:3",
                "cpe:/a:redhat:certificate_system:10",
                "cpe:/a:redhat:certificate_system:11",
                "cpe:/a:redhat:debezium:3",
                "cpe:/a:redhat:jboss_enterprise_application_platform:7",
                "cpe:/a:redhat:jboss_enterprise_application_platform:8",
                "cpe:/a:redhat:jboss_fuse:7",
                "cpe:/a:redhat:jbosseapxp",
                "cpe:/a:redhat:quarkus:3",
                "cpe:/a:redhat:red_hat_single_sign_on:7",
                "cpe:/a:redhat:satellite:6",
                "cpe:/o:redhat:enterprise_linux:10",
                "cpe:/o:redhat:enterprise_linux:8",
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "redhat",
                "redhat$PRODUCT$apicurio_registry",
                "redhat$PRODUCT$build_keycloak",
                "redhat$PRODUCT$camel_quarkus",
                "redhat$PRODUCT$certificate_system",
                "redhat$PRODUCT$debezium",
                "redhat$PRODUCT$enterprise_linux",
                "redhat$PRODUCT$jboss_enterprise_application_platform",
                "redhat$PRODUCT$jboss_fuse",
                "redhat$PRODUCT$jbosseapxp",
                "redhat$PRODUCT$quarkus",
                "redhat$PRODUCT$red_hat_single_sign_on",
                "redhat$PRODUCT$satellite"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/security/cve/CVE-2026-89059",
                "https://bugzilla.redhat.com/show_bug.cgi?id=2519756",
                "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 7.5,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "646315fc-7b86-4c14-9bf2-3bd1f6a74f28"
      },
      {
        "created": "2026-09-18T12:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://nvd.nist.gov/vuln/detail/CVE-2026-89059",
                "https://www.cve.org/CVERecord?id=CVE-2026-89059"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {},
              "removed": {},
              "updated": {
                "threat_severity": {
                  "new": "Important",
                  "old": null
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "e2623dba-23c0-4fb2-ad84-10cd7a0b507c"
      },
      {
        "created": "2026-09-18T12:45:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "0371c5e0-f087-452e-8abc-b4790ad42533"
      },
      {
        "created": "2026-09-19T14:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "poc",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "a10d9844-0feb-4742-a36e-6ad0e3e2ba06"
      },
      {
        "created": "2026-09-21T19:45:00+00:00",
        "data": [
          {
            "details": [
              "redhat$PRODUCT$build_of_apache_camel_for_quarkus",
              "redhat$PRODUCT$build_of_apicurio_registry",
              "redhat$PRODUCT$build_of_debezium_3",
              "redhat$PRODUCT$build_of_keycloak",
              "redhat$PRODUCT$build_of_quarkus",
              "redhat$PRODUCT$dogtag_certificate_system",
              "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack",
              "redhat$PRODUCT$quay_3",
              "redhat$PRODUCT$satellite_6",
              "redhat$PRODUCT$single_sign-on"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "redhat$PRODUCT$build_of_apache_camel_for_quarkus",
                "redhat$PRODUCT$build_of_apicurio_registry",
                "redhat$PRODUCT$build_of_debezium_3",
                "redhat$PRODUCT$build_of_keycloak",
                "redhat$PRODUCT$build_of_quarkus",
                "redhat$PRODUCT$dogtag_certificate_system",
                "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack",
                "redhat$PRODUCT$quay_3",
                "redhat$PRODUCT$satellite_6",
                "redhat$PRODUCT$single_sign-on"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "9c3fc3d3-2f94-4396-a1f8-f7fb71872953"
      },
      {
        "created": "2026-10-15T18:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:/a:redhat:quarkus:3.27::el8"
              ],
              "removed": [
                "cpe:/a:redhat:quarkus:3"
              ]
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:83082"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "ad6a5ce9-e1a2-4e51-ba12-abf8c77fab20"
      },
      {
        "created": "2026-10-15T23:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:/a:redhat:quarkus:3.33::el8"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:83520"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "5a1937a7-9c63-4351-b903-7649ba1966a2"
      },
      {
        "created": "2026-10-19T16:00:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:/a:redhat:enterprise_linux:9::appstream"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:85234"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "bdb52f92-b99a-40fc-83ad-dfd1712f9232"
      },
      {
        "created": "2026-10-29T19:45:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:/o:redhat:enterprise_linux:10.2"
              ],
              "removed": [
                "cpe:/o:redhat:enterprise_linux:10"
              ]
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:92408"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "cfa14f1f-a929-4f42-8a73-0d22b066c70c"
      },
      {
        "created": "2026-11-04T15:00:00+00:00",
        "data": [
          {
            "details": [
              "redhat$PRODUCT$jboss_enterprise_application_platform_xp"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "redhat$PRODUCT$jboss_enterprise_application_platform_xp"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:95221"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "f495639d-c40a-4765-aef9-01c5ed94a2ed"
      },
      {
        "created": "2026-11-05T00:00:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:/a:redhat:enterprise_linux:8",
                "cpe:/a:redhat:enterprise_linux:9"
              ],
              "removed": [
                "cpe:/o:redhat:enterprise_linux:8",
                "cpe:/o:redhat:enterprise_linux:9"
              ]
            },
            "type": "cpes"
          }
        ],
        "id": "bc974137-2f77-473e-ac7d-38c6e5f6a959"
      },
      {
        "created": "2026-11-05T08:30:00+00:00",
        "data": [
          {
            "details": [
              "redhat$PRODUCT$enterprise_linux_eus"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:/o:redhat:enterprise_linux_eus:10.0"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "redhat$PRODUCT$enterprise_linux_eus"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:95466"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "4b255df2-9717-45f9-885a-8718e2e95072"
      },
      {
        "created": "2026-11-05T12:30:00+00:00",
        "data": [
          {
            "details": [
              "redhat$PRODUCT$rhel_e4s"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:/a:redhat:rhel_e4s:9.4::appstream"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "redhat$PRODUCT$rhel_e4s"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:95505"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "66c8a639-d17a-4749-93ee-e7fba401bd45"
      }
    ],
    "cpes": {
      "data": [
        "cpe:/a:redhat:apicurio_registry:3",
        "cpe:/a:redhat:build_keycloak:",
        "cpe:/a:redhat:camel_quarkus:3",
        "cpe:/a:redhat:certificate_system:10",
        "cpe:/a:redhat:certificate_system:11",
        "cpe:/a:redhat:debezium:3",
        "cpe:/a:redhat:enterprise_linux:8",
        "cpe:/a:redhat:enterprise_linux:9",
        "cpe:/a:redhat:enterprise_linux:9::appstream",
        "cpe:/a:redhat:jboss_enterprise_application_platform:7",
        "cpe:/a:redhat:jboss_enterprise_application_platform:8",
        "cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0",
        "cpe:/a:redhat:jboss_fuse:7",
        "cpe:/a:redhat:jbosseapxp",
        "cpe:/a:redhat:quarkus:3.27::el8",
        "cpe:/a:redhat:quarkus:3.33::el8",
        "cpe:/a:redhat:red_hat_single_sign_on:7",
        "cpe:/a:redhat:rhel_e4s:9.4::appstream",
        "cpe:/a:redhat:satellite:6",
        "cpe:/o:redhat:enterprise_linux:10.2",
        "cpe:/o:redhat:enterprise_linux_eus:10.0"
      ],
      "providers": [
        "mitre"
      ]
    },
    "created": {
      "data": "2026-09-17T14:00:00+00:00",
      "provider": "redhat"
    },
    "description": {
      "data": "A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 7.5,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00892
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "poc",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": "Important",
        "provider": "redhat"
      }
    },
    "references": {
      "data": [
        "https://access.redhat.com/errata/RHSA-2026:83082",
        "https://access.redhat.com/errata/RHSA-2026:83520",
        "https://access.redhat.com/errata/RHSA-2026:85234",
        "https://access.redhat.com/errata/RHSA-2026:92408",
        "https://access.redhat.com/errata/RHSA-2026:95221",
        "https://access.redhat.com/errata/RHSA-2026:95466",
        "https://access.redhat.com/errata/RHSA-2026:95505",
        "https://access.redhat.com/security/cve/CVE-2026-89059",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2519756",
        "https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb",
        "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-89059",
        "https://www.cve.org/CVERecord?id=CVE-2026-89059"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat",
        "vulnrichment"
      ]
    },
    "title": {
      "data": "Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-11-05T12:04:16.323000+00:00",
      "provider": "mitre"
    },
    "vendors": {
      "data": [
        "redhat",
        "redhat$PRODUCT$apicurio_registry",
        "redhat$PRODUCT$build_keycloak",
        "redhat$PRODUCT$build_of_apache_camel_for_quarkus",
        "redhat$PRODUCT$build_of_apicurio_registry",
        "redhat$PRODUCT$build_of_debezium_3",
        "redhat$PRODUCT$build_of_keycloak",
        "redhat$PRODUCT$build_of_quarkus",
        "redhat$PRODUCT$camel_quarkus",
        "redhat$PRODUCT$certificate_system",
        "redhat$PRODUCT$debezium",
        "redhat$PRODUCT$dogtag_certificate_system",
        "redhat$PRODUCT$enterprise_linux",
        "redhat$PRODUCT$enterprise_linux_eus",
        "redhat$PRODUCT$jboss_enterprise_application_platform",
        "redhat$PRODUCT$jboss_enterprise_application_platform_expansion_pack",
        "redhat$PRODUCT$jboss_enterprise_application_platform_xp",
        "redhat$PRODUCT$jboss_fuse",
        "redhat$PRODUCT$jbosseapxp",
        "redhat$PRODUCT$quarkus",
        "redhat$PRODUCT$quay_3",
        "redhat$PRODUCT$red_hat_single_sign_on",
        "redhat$PRODUCT$rhel_e4s",
        "redhat$PRODUCT$satellite",
        "redhat$PRODUCT$satellite_6",
        "redhat$PRODUCT$single_sign-on"
      ],
      "providers": [
        "mitre",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-409"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    }
  },
  "redhat": {
    "cpes": [],
    "created": "2026-09-17T14:00:00+00:00",
    "description": "A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
      },
      "threat_severity": "Important"
    },
    "redhat_repo_path": "2026/CVE-2026-89059.json",
    "references": [
      "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-89059",
      "https://www.cve.org/CVERecord?id=CVE-2026-89059"
    ],
    "title": "resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)",
    "updated": "2026-09-17T14:00:00+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-409"
    ]
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-09-18T07:13:39.763000+00:00",
    "description": "A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "poc",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [
      "https://bugzilla.redhat.com/show_bug.cgi?id=2519756",
      "https://github.com/resteasy/resteasy/security/advisories/GHSA-m4pc-7gc7-9vw2"
    ],
    "title": "Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)",
    "updated": "2026-09-18T15:13:04.153000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/89xxx/CVE-2026-89059.json",
    "weaknesses": []
  }
}