CVE-2026-89059: RESTEasy IIOImageProvider DOS Vulnerability

CVE-2026-89059 Overview

CVE-2026-89059 is a denial-of-service vulnerability in RESTEasy's IIOImageProvider. The provider decodes attacker-supplied image request bodies without enforcing limits on declared image dimensions or pixel count. A remote, unauthenticated attacker can submit a small crafted image that declares enormous dimensions, forcing the Java Virtual Machine (JVM) to allocate very large memory buffers during decoding. The resulting heap exhaustion causes the server to become unresponsive. The flaw is classified under [CWE-409] (Improper Handling of Highly Compressed Data). RESTEasy is the JAX-RS implementation used across JBoss EAP, WildFly, and Quarkus-adjacent deployments, giving this issue broad exposure in Java REST services that accept image uploads.

Critical Impact
Unauthenticated attackers can exhaust JVM heap memory with a single small HTTP request, causing denial of service against any RESTEasy endpoint accepting image content.

Affected Products

RESTEasy IIOImageProvider (JAX-RS image provider component)
Applications embedding RESTEasy that expose endpoints consuming image media types
Downstream distributions tracked in the Red Hat CVE Advisory

Discovery Timeline

2026-09-18 - CVE-2026-89059 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-89059

Vulnerability Analysis

RESTEasy's org.jboss.resteasy.plugins.providers.IIOImageProvider uses Java's ImageIO framework to deserialize inbound image entities into BufferedImage objects. The provider reads the width, height, and color model declared in the image header, then allocates a decoded pixel buffer sized to those declarations. No ceiling is applied to the declared dimensions before allocation. A request body that is only a few kilobytes on the wire can declare a pixel grid requiring gigabytes of contiguous heap. The JVM attempts the allocation, triggers OutOfMemoryError, and either terminates the worker thread pool or halts request processing. Because the vulnerable code path runs before authentication in most deployments, any exposed endpoint that consumes image media types is reachable by unauthenticated clients.

Root Cause

The root cause is missing input validation on decoded image size. The provider trusts the dimension metadata embedded in the image and passes it directly to the underlying ImageReader without a pre-decode sanity check. The RESTEasy issue tracker records this as RESTEASY-3793.

Attack Vector

Exploitation requires a single HTTP request. The attacker sends a small crafted image, such as a PNG or TIFF with a manipulated IHDR chunk, to any RESTEasy resource method that binds a request body to IIOImageProvider. No credentials, user interaction, or prior foothold is required.

java

// Patch excerpt from resteasy-core-spi Messages.java
// Source: https://github.com/resteasy/resteasy/commit/7c7e6b37c8b2451a37aed9cdc6978b447456bacb
import java.util.function.Supplier;

import jakarta.validation.ElementKind;
import jakarta.ws.rs.BadRequestException;
import jakarta.ws.rs.core.MediaType;
import jakarta.ws.rs.core.Response.Status;

The upstream fix introduces a BadRequestException path so oversized images are rejected with an HTTP 400 before any large allocation occurs.

Detection Methods for CVE-2026-89059

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Java heap space entries in application server logs tied to IIOImageProvider or javax.imageio stack frames.
Sudden JVM heap saturation followed by full garbage collection storms on hosts running RESTEasy.
Small inbound HTTP POST or PUT requests to image-consuming endpoints that correlate with worker thread stalls.

Detection Strategies

Instrument request filters to log declared Content-Length alongside decoded image dimensions and flag disproportionate ratios.
Monitor JVM metrics for abrupt heap growth immediately following requests to endpoints annotated with image media types.
Enable request body sampling on web application firewalls to identify malformed image headers declaring dimensions above operational norms.

Monitoring Recommendations

Track OutOfMemoryError occurrences per service and alert on rate changes.
Correlate application server access logs with heap telemetry to identify request signatures that precede crashes.
Review network traffic to REST endpoints for image payloads originating from unauthenticated sources.

How to Mitigate CVE-2026-89059

Immediate Actions Required

Upgrade RESTEasy to the version containing commit 7c7e6b37c8b2451a37aed9cdc6978b447456bacb from the GitHub Resteasy Commit.
Set the dev.resteasy.image.threshold property to a value appropriate for your workload once patched.
Restrict unauthenticated access to endpoints that consume image media types where feasible.

Patch Information

The fix is tracked as RESTEASY-3793 and documented in the GitHub Security Advisory. Red Hat provides distribution-specific package updates through the Red Hat CVE Advisory and the Red Hat Bug Report. The patch introduces a configurable maximum estimated decoded image size, defaulting to 200 MB, and rejects oversized images with an HTTP 400 response before decoding.

Workarounds

Place a reverse proxy or WAF rule in front of RESTEasy services to reject image payloads whose declared dimensions exceed a safe ceiling.
Disable or remove IIOImageProvider registration in applications that do not require inbound image binding.
Lower the JVM maximum heap size and enable request rate limiting to reduce blast radius while patching is scheduled.

bash

# Configuration example: set the patched threshold to 100 MB
# System property applied at JVM startup for RESTEasy 3793+
-Ddev.resteasy.image.threshold=100MB

# A value of -1 disables validation; do not use in production
# Units are binary and case-insensitive (B, KB, MB, GB, TB)