RLSA-2026:98494: Important: resteasy security update
RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.
Security Fix(es):
resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/resteasyto a version that resolves this vulnerability.Fixed in 0:3.0.26-20.el9_8.1
Event History
Frequently Asked Questions
Which components and attack scenarios are covered by this update?
The update addresses two issues in resteasy-core: an unbounded image decode that can lead to denial of service through decompression-bomb images, and a CORS issue in CorsFilter involving arbitrary Origin reflection when credentials are used with a wildcard configuration.
Is authentication or user interaction required for the denial-of-service issue?
No. The supplied CVSS vector for the advisory is AV:N/AC:L/PR:N/UI:N, indicating network reachability, low attack complexity, and no required privileges or user interaction.
Are all RESTEasy deployments exposed to the CORS issue?
The provided information identifies the CORS issue as occurring under a wildcard CORS configuration with credentials. It does not establish that deployments without that configuration are affected.
What is the immediate risk if the image-decoding issue is exploited?
The described impact is denial of service caused by unbounded image decoding of a decompression-bomb image. The supplied CVSS vector indicates availability impact but no confidentiality or integrity impact.