CVE-2024-1726 is a vulnerability in Quarkus's RESTEasy Reactive component where security checks for certain inherited JAX-RS endpoints occur after serialization. This sequencing causes increased processing resource consumption during HTTP request handling. If an attacker knows any POST, PUT, or PATCH request paths, they can identify vulnerable endpoints and cause excessive resource usage, resulting in denial of service. Red Hat's advisory confirms the issue affects their build of Quarkus and rates it as important. No patch or mitigation currently meets Red Hat's criteria for deployment and stability. The vulnerability has a CVSS v3.1 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and impacts availability only.

The vulnerability allows an unauthenticated attacker with knowledge of certain HTTP request paths to cause excessive resource consumption on affected Quarkus RESTEasy Reactive endpoints, leading to denial of service. There is no impact on confidentiality or integrity. The CVSS score of 5.3 reflects a medium severity denial of service risk. No known exploits are reported in the wild at this time.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories and apply updates once a fix is released. Until then, consider restricting access to sensitive endpoints or applying network-level protections to limit exposure to potentially vulnerable POST, PUT, or PATCH endpoints.