CVE-2026-89059 is a denial of service vulnerability in RESTEasy's IIOImageProvider component. The flaw arises because the image decoder does not enforce limits on the declared image dimensions or pixel count in attacker-supplied image request bodies. An attacker can exploit this by sending a small crafted image that declares enormous dimensions, causing the system to allocate a very large amount of memory, exhausting the JVM heap and resulting in a denial of service. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. The issue is tracked by Red Hat and others, with references to a GitHub commit and advisories. No explicit patch availability is stated in the provided data, and the vendor advisory does not confirm a fix but discusses investigation and mitigation options.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by exhausting JVM heap memory through unbounded image decoding. This leads to resource consumption that can degrade system performance or crash the affected application, impacting availability. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory notes the issue is under investigation or affected status for some products, with potential fixes to be released. Until a fix is available, users should monitor vendor communications and consider applying any recommended mitigations from the vendor or upgrading to fixed versions once released.