CVE-2026-16308

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16308", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-20T14:31:00.798Z", "datePublished": "2026-07-30T14:04:42.806Z", "dateUpdated": "2026-07-30T16:20:01.475Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-30T14:04:42.806Z"}, "title": "IBM Enterprise Build of Quarkus is affected by a DoS vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Enterprise Build of Quarkus", "versions": [{"status": "affected", "version": "3.27.1", "lessThanOrEqual": "3.27.4.SP2", "versionType": "semver"}, {"status": "affected", "version": "3.33.1", "lessThanOrEqual": "3.33.2.SP2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:sp2:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:sp2:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281904", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "solutions": [{"lang": "en", "value": "The issues are addressed in IBM Enterprise Build of Quarkus 3.27.4.SP3 and 3.33.2.SP3. To update your project to IBM Enterprise Build of Quarkus 3.27.4.SP3 or 3.33.2.SP3, follow the instructions in the\u00a0 product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The issues are addressed in IBM Enterprise Build of Quarkus 3.27.4.SP3 and 3.33.2.SP3. To update your project to IBM Enterprise Build of Quarkus 3.27.4.SP3 or 3.33.2.SP3, follow the instructions in the\u00a0<a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>"}]}], "credits": [{"lang": "en", "value": "Mike Read (JP Morgan)", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T16:19:53.535229Z", "id": "CVE-2026-16308", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T16:20:01.475Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16308", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T16:19:53.535229Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T16:19:56.091Z"}}], "cna": {"title": "IBM Enterprise Build of Quarkus is affected by a DoS vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Mike Read (JP Morgan)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:sp2:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:sp2:*:*:*:*:*:*"], "vendor": "IBM", "product": "Enterprise Build of Quarkus", "versions": [{"status": "affected", "version": "3.27.1", "versionType": "semver", "lessThanOrEqual": "3.27.4.SP2"}, {"status": "affected", "version": "3.33.1", "versionType": "semver", "lessThanOrEqual": "3.33.2.SP2"}]}], "solutions": [{"lang": "en", "value": "The issues are addressed in IBM Enterprise Build of Quarkus 3.27.4.SP3 and 3.33.2.SP3. To update your project to IBM Enterprise Build of Quarkus 3.27.4.SP3 or 3.33.2.SP3, follow the instructions in the\u00a0 product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .", "supportingMedia": [{"type": "text/html", "value": "<p>The issues are addressed in IBM Enterprise Build of Quarkus 3.27.4.SP3 and 3.33.2.SP3. To update your project to IBM Enterprise Build of Quarkus 3.27.4.SP3 or 3.33.2.SP3, follow the instructions in the\u00a0<a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281904", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-30T14:04:42.806Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16308", "state": "PUBLISHED", "dateUpdated": "2026-07-30T16:20:01.475Z", "dateReserved": "2026-07-20T14:31:00.798Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-07-30T14:04:42.806Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:sp2:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:sp2:*:*:*:*:*:*"], "product": "Enterprise Build of Quarkus", "vendor": "IBM", "versions": [{"lessThanOrEqual": "3.27.4.SP2", "status": "affected", "version": "3.27.1", "versionType": "semver"}, {"lessThanOrEqual": "3.33.2.SP2", "status": "affected", "version": "3.33.1", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes."}, {"lang": "es", "value": "La Construcci\u00f3n empresarial de IBM de Quarkus 3.27.1 hasta 3.27.4.SP2, y 3.33.1 hasta 3.33.2.SP2 Quarkus REST podr\u00eda permitir a un atacante remoto causar una denegaci\u00f3n de servicio debido a la acumulaci\u00f3n ilimitada de bytes de encabezado de parte MIME multiparte."}], "id": "CVE-2026-16308", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16308", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T16:19:53.535229Z", "version": "2.0.3"}}]}, "published": "2026-07-30T15:16:26.910", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7281904"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:47189", "cpe": "cpe:/a:redhat:quarkus:3.27::el8", "package": "resteasy-reactive-client-processor", "product_name": "Red Hat build of Quarkus 3.27.4.SP3", "release_date": "2026-07-29T00:00:00Z"}], "bugzilla": {"description": "io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service", "id": "2506373", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506373"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-770", "details": ["A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-16308", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "resteasy-reactive-client-processor", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "resteasy-reactive-common-processor", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "resteasy-reactive-client-processor", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "resteasy-reactive-common-processor", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Not affected", "package_name": "resteasy-reactive-common-processor", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "resteasy-reactive-common-processor", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "resteasy-reactive-client-processor", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "resteasy-reactive-common", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "resteasy-reactive-common-processor", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Under investigation", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Under investigation", "package_name": "devspaces/multicluster-redirector-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "resteasy-reactive-client-processor", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "resteasy-reactive-common-processor", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "resteasy-reactive-client-processor", "product_name": "streams for Apache Kafka 3"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "resteasy-reactive-common-processor", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-07-29T13:19:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-16308\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16308"], "statement": "This is an Important flaw in Quarkus REST / RESTEasy Reactive's MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service. By sending a crafted multipart/form-data request with an excessively large part-header section, the attacker can exhaust the JVM heap, leading to application crashes. This vulnerability does not require valid form field names or authentication.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.27"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "quarkus", "vendor": "redhat"}], "created": "2026-07-30T04:30:04.753276+00:00", "updated": "2026-08-02T05:30:06.551109+00:00", "vendors": ["redhat", "redhat$PRODUCT$quarkus"]}