CVE-2026-89059: Red Hat Build Of Apache Camel 4 For Quarkus 3

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Affected products

• Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
• Red Hat Red Hat Build Of Apicurio Registry 3
• Red Hat Red Hat Build Of Debezium 3
• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Build Of Quarkus
• Red Hat Red Hat Certificate System 10
• Red Hat Red Hat Certificate System 11
• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 8
• Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
• Red Hat Red Hat Satellite 6
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-18. Last modified 2026-10-09.