Описание
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash.
Отчет
This is an Important flaw in Quarkus REST / RESTEasy Reactive's MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service. By sending a crafted multipart/form-data request with an excessively large part-header section, the attacker can exhaust the JVM heap, leading to application crashes. This vulnerability does not require valid form field names or authentication.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | resteasy-reactive-client-processor | Affected | ||
| Cryostat 4 | resteasy-reactive-common-processor | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | resteasy-reactive-client-processor | Affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | resteasy-reactive-common-processor | Affected | ||
| Red Hat build of Apicurio Registry 3 | resteasy-reactive-common-processor | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | resteasy-reactive-client-processor | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | resteasy-reactive-common | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | resteasy-reactive-common-processor | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-trustyai-service-rhel9 | Under investigation | ||
| Red Hat OpenShift Dev Spaces | devspaces/multicluster-redirector-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
EPSS
7.5 High
CVSS3