RHSA-2026:95505: Important: resteasy security update

Q: Which RESTEasy deployments should be prioritized for remediation?

Prioritize applications that process attacker-controlled images through RESTEasy's IIOImageProvider, as well as applications using CorsFilter with a wildcard origin configuration and credentials enabled. These are the affected conditions identified by the two security fixes.

Q: Does the advisory indicate whether default RESTEasy configurations are affected?

No. The provided advisory does not state whether either issue is exploitable with default RESTEasy settings.

Published Nov 5, 2026

Updated

Important: resteasy security update

Other sources

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.Security Fix(es): resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat

Affected Software

14 affected componentsFixes available

Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for ARM 64 - 4 years of updates

Red Hat Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle

Red Hat Red Hat Enterprise Linux for IBM z Systems - 4 years of updates

Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle

Red Hat Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions

Red Hat Red Hat Enterprise Linux Server - AUS

redhat/resteasy<3.0.26-20.el9_4.2

3.0.26-20.el9_4.2

redhat/pki-resteasy-client<3.0.26-20.el9_4.2

3.0.26-20.el9_4.2

redhat/pki-resteasy-core<3.0.26-20.el9_4.2

3.0.26-20.el9_4.2

redhat/pki-resteasy-jackson2-provider<3.0.26-20.el9_4.2

3.0.26-20.el9_4.2

redhat/pki-resteasy-servlet-initializer<3.0.26-20.el9_4.2

3.0.26-20.el9_4.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/resteasy to a version that resolves this vulnerability.
Fixed in 3.0.26-20.el9_4.2
Upgrade
Upgrade redhat/pki-resteasy-client to a version that resolves this vulnerability.
Fixed in 3.0.26-20.el9_4.2
Upgrade
Upgrade redhat/pki-resteasy-core to a version that resolves this vulnerability.
Fixed in 3.0.26-20.el9_4.2
Upgrade
Upgrade redhat/pki-resteasy-jackson2-provider to a version that resolves this vulnerability.
Fixed in 3.0.26-20.el9_4.2
Upgrade
Upgrade redhat/pki-resteasy-servlet-initializer to a version that resolves this vulnerability.
Fixed in 3.0.26-20.el9_4.2

Event History

Nov 5, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Advisory Published

via Red Hat·10:48 AM

Data Sourced

via Red Hat·10:48 AM

Severity

Frequently Asked Questions

Which RESTEasy deployments should be prioritized for remediation?

Prioritize applications that process attacker-controlled images through RESTEasy's IIOImageProvider, as well as applications using CorsFilter with a wildcard origin configuration and credentials enabled. These are the affected conditions identified by the two security fixes.

Does the advisory indicate whether default RESTEasy configurations are affected?

No. The provided advisory does not state whether either issue is exploitable with default RESTEasy settings.

RHSA-2026:95505: Important: resteasy security update

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which RESTEasy deployments should be prioritized for remediation?

Does the advisory indicate whether default RESTEasy configurations are affected?

Company

Resources

Contact

Frequently Asked Questions

Which RESTEasy deployments should be prioritized for remediation?

Does the advisory indicate whether default RESTEasy configurations are affected?