Critical Security Update for pki-resteasy Packages: CVE-2026-89058 and CVE-2026-89059
Summary
RHSA-2026:85234: Red Hat Security Advisory: resteasy security update. Affects pki-resteasy-client versions < 0:3.0.26-20.el9_8.1. Fixed in 0:3.0.26-20.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The pki-resteasy packages are essential components of the Red Hat Enterprise Linux ecosystem, providing RESTful web services for Public Key Infrastructure (PKI) applications. These packages facilitate secure communication and data exchange in various applications, making them critical for maintaining the integrity and confidentiality of sensitive information. However, recent vulnerabilities have been identified that could potentially compromise the security of applications relying on these packages.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-89058 and CVE-2026-89059 stem from weaknesses in the pki-resteasy packages, which may allow unauthorized access or manipulation of data. These vulnerabilities could lead to significant security breaches, including data leaks or unauthorized actions within applications that utilize these packages. The vulnerabilities are particularly concerning due to their potential impact on the confidentiality and integrity of sensitive information processed by PKI applications.
How To Fix
Minimum fixed version
0:3.0.26-20.el9_8.1
This is the first release that contains the fix.
sudo dnf update pki-resteasy-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the packages is not immediately feasible, consider restricting access to the affected services or implementing additional authentication layers to mitigate potential risks until the packages can be updated.
Conclusion
In summary, the vulnerabilities CVE-2026-89058 and CVE-2026-89059 in the pki-resteasy packages pose significant security risks. It is crucial to update the affected packages to the patched version 0:3.0.26-20.el9_8.1 to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for pki-resteasy-client →
FAQ
These are identifiers for specific vulnerabilities found in the pki-resteasy packages that could allow unauthorized access or manipulation of data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
You can update the affected packages using the command: sudo dnf update pki-resteasy-client pki-resteasy-core pki-resteasy-jackson2-provider pki-resteasy-servlet-initializer resteasy.
Yes, you can use the Vulert playground to monitor vulnerabilities in your application without requiring any installation or signup.
Related vulnerabilities
Recent vulnerabilities recorded for pki-resteasy-client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
