Critical Security Update for RESTEasy Packages: Addressing Decompression-Bomb DoS and Credential Reflection Vulnerabilities
Summary
ALSA-2026:85234: Important: resteasy security update. Affects pki-resteasy-client versions < 3.0.26-20.el9_8.1. Fixed in 3.0.26-20.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RESTEasy is a JBoss project that provides frameworks for building RESTful web services and Java applications. It is a fully certified and portable implementation of the JAX-RS specification, allowing developers to create scalable and efficient web services. However, recent vulnerabilities have been identified in its core components, which could lead to significant security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified in RESTEasy include a Decompression-Bomb Denial of Service (DoS) attack vector through the IIOImageProvider (CVE-2026-89059) and a security flaw in the CorsFilter that reflects arbitrary origins with credentials under wildcard configurations (CVE-2026-89058). These vulnerabilities can be exploited by attackers to cause service disruptions or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
3.0.26-20.el9_8.1
This is the first release that contains the fix.
sudo dnf update pki-resteasy-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict the use of the CorsFilter to specific origins rather than allowing wildcard configurations. This can be done by modifying the configuration settings in your application to specify allowed origins explicitly.
Conclusion
In summary, the identified vulnerabilities in RESTEasy pose significant security risks that can lead to service disruptions and unauthorized access. It is crucial to update the affected packages to the latest patched versions to ensure the security of your applications. Additionally, implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for pki-resteasy-client →
FAQ
The main vulnerabilities include a Decompression-Bomb DoS attack and a CorsFilter issue that reflects arbitrary origins with credentials.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
A Decompression-Bomb DoS attack occurs when an attacker sends a specially crafted file that, when decompressed, consumes excessive resources, potentially crashing the service.
The CorsFilter vulnerability allows attackers to exploit wildcard configurations to gain unauthorized access to resources by reflecting arbitrary origins with credentials.
While updating is the best solution, you can mitigate the risks by configuring your application to restrict origins explicitly in the CorsFilter.
Related vulnerabilities
Recent vulnerabilities recorded for pki-resteasy-client.
