Red Hat Patches Two RESTEasy Flaws Affecting Java Web Services on Enterprise Linux 9
Red Hat published security advisory RHSA-2026:85234 on 19 October 2026, rated Important, covering two vulnerabilities in the resteasy packages shipped with Red Hat Enterprise Linux 9. RESTEasy is the JBoss implementation of the JAX-RS specification and is used to build RESTful web services and RESTful Java applications, so the affected code sits in the request-handling path of any service built on it. The two issues are CVE-2026-89059, described as an unbounded image decode in the IIOImageProvider leading to a decompression-bomb denial of service, and CVE-2026-89058, a CorsFilter weakness in which an arbitrary Origin is reflected together with credentials when the filter is running under a wildcard configuration. Both are fixed in resteasy-3.0.26-20.el9_8.1, delivered as the pki-resteasy-client, pki-resteasy-core, pki-resteasy-jackson2-provider and pki-resteasy-servlet-initializer noarch packages. The advisory covers RHEL 9 on x86_64, s390x, ppc64le and aarch64, and extends to the 9.8 Extended Update Support, Update Services for SAP Solutions, four-years-of-updates and Extended Life Cycle channels, which means long-lifecycle and SAP estates are in scope alongside mainstream RHEL 9 builds.
Red Hat's errata names both weaknesses but does not publish a step-by-step exploitation path, and the CVSS base scores are held on the individual CVE pages rather than in the advisory text itself. What the vendor's own descriptions make clear is the nature of each defect. In CVE-2026-89059 the IIOImageProvider decodes inbound image content without an upper bound, the classic decompression-bomb pattern in which a small, well-formed file expands to an enormous in-memory raster and consumes heap and CPU on the server that parses it. In CVE-2026-89058 the CorsFilter, when configured with a wildcard allowed-origin value, echoes the requesting site's Origin header back in the response while still permitting credentials, which collapses the browser-enforced separation that cross-origin resource sharing is supposed to maintain. Red Hat tracks the two issues internally as Bugzilla 2519756 and 2519775 and has rated the combined update Important under its own severity classification.
The practical exposure differs between the two flaws. The image-decode issue is an availability problem on any RESTEasy endpoint that accepts image uploads or image media types, where a single crafted request can tie up memory and processing capacity out of all proportion to its size, and repeated requests can degrade or stall a service without any authentication. The CORS reflection issue is a confidentiality problem that plays out in the victim's browser rather than on the server: where a deployment runs the wildcard configuration, a malicious page visited by an authenticated user can issue credentialed cross-origin requests and read responses it should never be allowed to see, including session-bound data returned by the API. Because resteasy here is packaged as pki-resteasy subcomponents distributed across the EUS, SAP and Extended Life Cycle streams, affected systems are often long-lived infrastructure hosts rather than frequently rebuilt application servers, and inventory of those estates tends to be weaker. On current exploitation status, FIRST EPSS places CVE-2026-89059 at a 0.8 percent probability of exploitation in the next 30 days and CVE-2026-89058 at 0.3 percent, and neither the vendor advisory nor the available evidence records exploitation in the wild. That places this firmly in the routine-patch category, with the caveat that low-complexity denial-of-service bugs in widely embedded web frameworks are cheap for opportunistic actors to weaponise once details circulate.
Attack Surface
Web Application, Server OS
Tactics
Initial Access, Collection, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
- T1185 – Browser Session Hijacking
SuperPRO's Threat Countermeasures Procedures
- Apply RHSA-2026:85234 and bring resteasy to 3.0.26-20.el9_8.1 on RHEL 9, updating the pki-resteasy-client, pki-resteasy-core, pki-resteasy-jackson2-provider and pki-resteasy-servlet-initializer noarch packages; verify with 'rpm -q pki-resteasy-core' on each host.
- Query the estate for affected builds across all shipped architectures with 'yum list installed | grep pki-resteasy' or a Satellite report, covering x86_64, s390x, ppc64le and aarch64 hosts on RHEL 9 as well as the 9.8 Extended Update Support, Update Services for SAP Solutions and Extended Life Cycle channels named in the advisory.
- Audit every RESTEasy deployment for CorsFilter instances where allowedOrigins is set to the wildcard value '*' together with allowCredentials enabled, which is the configuration CVE-2026-89058 abuses, and replace the wildcard with an explicit allow-list of trusted origin URLs.
- Enforce a maximum request body size on endpoints that accept image media types in front of RESTEasy (for example a client_max_body_size directive in nginx or LimitRequestBody in httpd) so a crafted decompression bomb targeting the IIOImageProvider cannot reach the decoder (CVE-2026-89059).
- Where an application does not need server-side image handling, remove or disable the IIOImageProvider entity provider registration so inbound image/* payloads are rejected rather than decoded.
- Set JVM heap ceilings and container memory limits on RESTEasy application servers and alert on OutOfMemoryError events or sustained heap-usage spikes correlated with POST or PUT requests carrying image content types, which is the observable effect of the unbounded decode.
- Verify the deployed packages against the advisory SHA-256 values before installation, including pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm (357e102218bd4114770c3aad97b2b7d3363deec57e3a0646489fc99c09b78567) and the source RPM resteasy-3.0.26-20.el9_8.1.src.rpm (0fcd76ee9f0de58116675645c494f4ab0e2d4505f61b77d0425e4722f3ce0bbb).
