Description:
RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification.
Security Fix(es):
* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
| Architecture |
Package |
Checksum |
| noarch |
pki-resteasy-client-3.0.26-20.el9_8.1.noarch.rpm |
12ba6b585b548ff34881a2362021ffd70e6449344ba8f9ef0fa4c221e737f245 |
| noarch |
pki-resteasy-core-3.0.26-20.el9_8.1.noarch.rpm |
420ce9a2cd9a7e8e0a3214c8da95bf1f1ff11d0d42ea5866da14a7f82b2297cc |
| noarch |
pki-resteasy-jackson2-provider-3.0.26-20.el9_8.1.noarch.rpm |
4377a151501801e2bd5032763346b037e657c3f863e624be06fa4f57f713cfda |
| noarch |
pki-resteasy-servlet-initializer-3.0.26-20.el9_8.1.noarch.rpm |
caec530dec585303d1fed45c8ec652d6e8d9fa1f7b73e998c1d0ae6eb562f919 |
