Threats affecting pkg:github/RESTEasy

A vulnerability in Red Hat RESTEasy's CorsFilter allows a permissive cross-origin policy when configured to allow all origins ("*"). This flaw causes the Origin header from requests to be reflected back in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true, enabling malicious websites to perform credentialed cross-origin requests and read authenticated responses from a victim's session, leading to confidentiality loss.

CVE-2026-89059 is a high-severity vulnerability in Red Hat RESTEasy's IIOImageProvider component. It allows a remote, unauthenticated attacker to send a crafted image with extremely large declared dimensions, causing excessive memory allocation and JVM heap exhaustion. This results in a denial of service (DoS) condition. The flaw affects REST endpoints configured to process image MIME types using the Java Image I/O provider. Versions prior to 6.2.19.Final and 7.0.5.Final are vulnerable.