RESTEasy Image Decoder Memory Exhaustion DoS

CVE-2026-89059 affects RESTEasy's IIOImageProvider component, which processes image data from HTTP request bodies without validating declared dimensions or pixel counts. An unauthenticated attacker can exploit this by sending a small, malicious image file that declares extremely large dimensions—forcing the JVM to allocate massive amounts of heap memory to decode the image metadata. This triggers an out-of-memory condition, crashing the application and denying service to legitimate users. Any organization running vulnerable RESTEasy versions in production environments faces immediate risk, particularly those exposing REST endpoints that accept image uploads or multipart form data without strict input validation.

While this CVE shows no mapped MITRE ATT&CK techniques, Casky's Claude-powered analysis would detect the attack pattern through resource exhaustion behavioral signatures and application error analysis. Practitioners using Casky would observe anomalous memory consumption spikes, unexpected JVM heap failures, and patterns consistent with CWE-409 (Improper Restriction of Rendered UI Layers or Frames). Extended reasoning capabilities would correlate small HTTP payloads with disproportionately large server resource consumption, distinguishing this DoS attack from legitimate traffic. The platform would flag suspicious image metadata declarations and highlight the absence of input dimension validation as a critical control gap, enabling defenders to prioritize patching and implement compensating controls such as image dimension limits and memory usage quotas on REST endpoints.