CVE-2026-16308 is a resource exhaustion vulnerability (CWE-770) affecting IBM Enterprise Build of Quarkus REST in specific versions. The flaw allows a remote attacker to cause a denial of service by sending multipart MIME requests that cause unbounded accumulation of part-header bytes, leading to allocation of resources without limits or throttling. The vulnerability affects versions 3.27.1 and 3.33.1 as explicitly stated, with the description indicating the affected ranges include up to 3.27.4.SP2 and 3.33.2.SP2. The CVSS v3.1 score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (denial of service). No official patch or remediation level is currently provided by the vendor, and no known exploits are reported in the wild.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service by exhausting server resources through unbounded accumulation of multipart MIME part-header bytes. This impacts service availability but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor IBM's advisories for updates. Until a patch is available, consider implementing network-level protections such as limiting request sizes or rate limiting multipart MIME requests to mitigate potential exploitation.