This vulnerability arises from RESTEasy's IIOImageProvider decoding image request bodies without enforcing limits on image dimensions or pixel count. An attacker can exploit this by sending a small crafted image that declares enormous dimensions, triggering very large memory allocations. This leads to exhaustion of the JVM heap and causes a denial of service condition. The issue affects Red Hat build of Apache Camel 4 for Quarkus 3 versions >=0 <6.2.19.Final and >=7.0.0.Alpha1 <7.0.5.Final. The CVSS v3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges or user interaction required, and high impact on availability.

The vulnerability allows remote unauthenticated attackers to cause a denial of service by exhausting JVM heap memory through crafted image requests with unbounded dimensions. This results in resource consumption leading to poor system performance or system crash. There is no impact on confidentiality or integrity.

Red Hat has published an advisory for CVE-2026-89059. Affected versions are identified, but the vendor advisory does not explicitly confirm the availability of a patch at this time. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-89059 for current remediation guidance. Until a fix is available, users should consider applying any recommended mitigations from Red Hat or upgrading to unaffected versions when they become available.