1770 matches found
ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1525 more potentially affected by CVE-2026-89058 via org.jboss.resteasy:resteasy-core (>=6.0.0.beta1, <=6.2.18.final)
org.jboss.resteasy:resteasy-core MAVEN version =6.0.0.beta1, =0.1.0, =0.1.0, =0.7.20, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =2.3.0, =1.0, =2.3.0, =0.5.10, =8.0.0, =8.0.0, =8.2.3 and more Source cves: CVE-2026-89058 Source advisory: SNYK:JAVA-ORGJBOSSRESTEAS...
Origin Validation Error
Overview org.jboss.resteasy:resteasy-core is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java. Affected versions of this package are vulnerable to Origin Validation Error via the response and preflight handli...
Origin Validation Error
Overview org.jboss.resteasy:resteasy-core-spi is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java. Affected versions of this package are vulnerable to Origin Validation Error via the response and preflight...
ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1525 more potentially affected by CVE-2026-89059 via org.jboss.resteasy:resteasy-core (>=6.0.0.beta1, <=6.2.18.final)
org.jboss.resteasy:resteasy-core MAVEN version =6.0.0.beta1, =0.1.0, =0.1.0, =0.7.20, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =2.3.0, =1.0, =2.3.0, =0.5.10, =8.0.0, =8.0.0, =8.2.3 and more Source cves: CVE-2026-89059 Source advisory: SNYK:JAVA-ORGJBOSSRESTEAS...
com.flipkart.krystal:lattice-graphql-rest (>=0.1.5, <=0.1.6), com.flipkart.krystal:lattice-rest (>=0.1.5, <=0.1.6) +197 more potentially affected by CVE-2026-89059 via org.jboss.resteasy:resteasy-core (>=7.0.0.alpha1, <=7.0.4.final)
org.jboss.resteasy:resteasy-core MAVEN version =7.0.0.alpha1, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =0.2.0, =0.9.0, =0.9.7 and more Source cves: CVE-2026-89059 Source advisory: SNYK:JAVA-ORGJBOSSRESTEASY-20044968...
Data Amplification
Overview org.jboss.resteasy:resteasy-core is a JBoss.org project aimed at providing productivity frameworks for developing client and server RESTful applications and services in Java. Affected versions of this package are vulnerable to Data Amplification in the readFrom method of IIOImageProvider...
DEBIAN-CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
DEBIAN-CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...
UBUNTU-CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...
UBUNTU-CVE-2026-89059
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...
EUVD-2026-82736
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1525 more potentially affected by CVE-2026-89058 via org.jboss.resteasy:resteasy-core (>=6.0.0.beta1, <=6.2.18.final)
org.jboss.resteasy:resteasy-core MAVEN version =6.0.0.beta1, =0.1.0, =0.1.0, =0.7.20, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =2.3.0, =1.0, =2.3.0, =0.5.10, =8.0.0, =8.0.0, =8.2.3 and more Source cves: CVE-2026-89058 Source advisory: MEND:CVE-2026-89058http...
com.flipkart.krystal:lattice-graphql-rest (>=0.1.5, <=0.1.6), com.flipkart.krystal:lattice-rest (>=0.1.5, <=0.1.6) +197 more potentially affected by CVE-2026-89058 via org.jboss.resteasy:resteasy-core (>=7.0.0.alpha1, <=7.0.4.final)
org.jboss.resteasy:resteasy-core MAVEN version =7.0.0.alpha1, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =0.2.0, =0.9.0, =0.9.7 and more Source cves: CVE-2026-89058 Source advisory: MEND:CVE-2026-89058...
CVE-2026-89058 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...