Red Hat Patches Two RESTEasy Flaws Affecting Extended Life Cycle Enterprise Linux Builds
Red Hat published errata RHSA-2026:95505 on 5 November 2026, delivering a security update for the resteasy packages on Red Hat Enterprise Linux 9.4 and rating the release Important. RESTEasy is the JBoss project that implements the JAX-RS specification and provides the framework used to build RESTful web services and Java applications, and on RHEL 9.4 it is shipped as the pki-resteasy component set used by the certificate and PKI services. Two issues are addressed: CVE-2026-89059, an unbounded image decode in the IIOImageProvider that enables a decompression-bomb style denial of service, and CVE-2026-89058, a flaw in which the CorsFilter reflects an arbitrary Origin together with credentials when running under a wildcard configuration. The affected channels are the long-tail ones: RHEL Server AUS 9.4, Update Services for SAP Solutions on x86_64 and Power LE, the four-years-of-updates streams for ARM 64 and IBM Z, and the Extended Life Cycle streams for x86_64, ARM 64, Power LE and IBM Z. Fixed builds are available as resteasy-3.0.26-20.el9_4.2.src.rpm with the corresponding pki-resteasy-client, pki-resteasy-core, pki-resteasy-jackson2-provider and pki-resteasy-servlet-initializer noarch packages.
Red Hat has not published step-by-step exploitation detail in the errata, so the mechanism is described only at the level the vendor gives it. CVE-2026-89059 sits in the IIOImageProvider, the component responsible for turning an inbound image body into a decoded image object; because the decode is unbounded, a small, heavily compressed image submitted to an endpoint that accepts image media types can expand into a very large in-memory raster, consuming heap and processor time out of proportion to the size of the request. CVE-2026-89058 concerns the CorsFilter, the server-side control that decides which cross-origin callers a browser may allow to read a response. Under a wildcard configuration the filter reflects whatever Origin the requester supplies while still permitting credentials, which weakens the separation that normally stops an unrelated website from reading an authenticated response belonging to a logged-in user. Neither Red Hat bug record, BZ 2519756 or BZ 2519775, is accompanied by a published proof-of-concept, and per-CVE CVSS base scores are carried on the individual CVE pages rather than in the errata text itself.
The practical exposure depends heavily on deployment. These packages underpin PKI and certificate-handling web services, so a RESTEasy availability bug touches a component that other parts of an estate depend on for trust decisions, and the CORS weakness only bites where a wildcard origin policy has actually been configured on a service handling authenticated sessions. The affected streams are also significant in their own right: AUS, Update Services for SAP Solutions and Extended Life Cycle subscriptions are chosen precisely by organisations running change-controlled SAP and regulated workloads, where maintenance windows are infrequent and systems stay on a pinned minor release for years. That combination means a known-vulnerable version can persist far longer on these hosts than on a standard RHEL 9 system that tracks the current minor release. On current exploitation status, FIRST EPSS puts CVE-2026-89059 at a 1.0% probability of exploitation in the next 30 days and CVE-2026-89058 at 0.3%, and neither CVE appears in any confirmed in-the-wild activity reported with this advisory. This is a scheduled-maintenance item rather than an incident, but the denial-of-service path is the one worth tracking, since an availability failure in a PKI-adjacent service can cascade into authentication and certificate issuance outages elsewhere.
Attack Surface
Web Application, Server OS
Tactics
Initial Access, Credential Access, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
- T1539 – Steal Web Session Cookie
SuperPRO's Threat Countermeasures Procedures
- Update resteasy to 3.0.26-20.el9_4.2 on all RHEL 9.4 hosts, which includes pki-resteasy-client, pki-resteasy-core, pki-resteasy-jackson2-provider and pki-resteasy-servlet-initializer at the same noarch build level; verify with 'rpm -q pki-resteasy-core' that the installed release is -20.el9_4.2 or later.
- Scope the fleet first with 'rpm -qa | grep pki-resteasy' across RHEL Server AUS 9.4, Update Services for SAP Solutions 9.4 on x86_64 and ppc64le, the four-year update streams for aarch64 and s390x, and the Extended Life Cycle 9.4 streams, since these are the only channels this errata ships to.
- Confirm the downloaded packages match the published SHA-256 values before deployment, including resteasy-3.0.26-20.el9_4.2.src.rpm (69ab6b520164a6bd506220145e09953c4361d9ee04642b444c6816782784be16) and pki-resteasy-core-3.0.26-20.el9_4.2.noarch.rpm (4f6e8eaf2ea111aed33afa1dc19ebcbb894621ac29d9740b3e739c9e50556b92).
- Audit CorsFilter configuration on every RESTEasy-backed service and replace any wildcard allowed-origin value with an explicit allow-list of trusted origins wherever credentialed requests are permitted, as CVE-2026-89058 only reflects an arbitrary Origin when a wildcard config is in use.
- Enforce a request body size limit on endpoints that accept image media types in front of RESTEasy, at the reverse proxy or load balancer, so that an oversized or heavily compressed payload reaching the IIOImageProvider is rejected before decode (CVE-2026-89059).
- Add monitoring on JVM heap usage and garbage-collection pauses for the PKI and Certificate System services, and alert on OutOfMemoryError entries or repeated heap exhaustion coinciding with inbound requests carrying image content types, which is the observable signature of a decompression-bomb attempt.
- Use Red Hat Insights patch analysis against RHSA-2026:95505 to identify systems still reporting the vulnerable resteasy build after the maintenance window, and track remaining hosts against Bugzilla records BZ 2519756 and BZ 2519775.
