Red Hat Security AdvisoryRHSA-2026:95505
resteasy security update
Released 2026-11-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.9.4) pki-resteasy-client-3.0.26-20.el9_4.2, pki-resteasy-core-3.0.26-20.el9_4.2, pki-resteasy-jackson2-provider-3.0.26-20.el9_4.2 +2
Fixes 2 records
Priority HIGH 72
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0153 · Published 2026-09-18 · Partial fix · 6.2.19.Final, 7.0.5.Final +6 CWE-409
Priority HIGH 66
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Crede…
CVSS 3.1HIGH 7.4· Network · No auth · User interaction · EPSS 0.00474 · Published 2026-09-18 · Partial fix · 6.2.19.Final, 7.0.5.Final +6 CWE-346
