Bug 2506373 (CVE-2026-16308)

Summary: CVE-2026-16308 io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, abrianik, adamevin, ant, anujha, aschwart, asoldano, aszczucz, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, chfoley, cmah, dandread, dhanak, dkreling, dlofthou, drichtar, drosa, dsimansk, eaguilar, ebaron, ewittman, fmongiar, ggrzybek, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, jmatsuok, jnethert, jpechane, jraez, jtolenti, kaycoth, kingland, lthon, manderse, mnovotny, mosmerov, mposolda, msvehla, nipatil, nwallace, olubyans, pantinor, parichar, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rgodfrey, rguimara, rjohnson, rkubis, rmartinc, rruss, rstancel, rsvoboda, sausingh, sbiarozk, sdawley, security-response-team, ssilvert, sthorger, swoodman, tasato, thjenkin, tqvarnst, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-23 10:01:39 UTC 
Quarkus REST / RESTEasy Reactive's MultipartParser accumulates MIME part-header bytes without any size or count limit. An unauthenticated remote attacker can send a single crafted multipart/form-data request with an arbitrarily large part-header section to exhaust the JVM heap and crash the application.


Additional details:
The MultipartParser state machine reads part-header bytes (header names and values within each MIME part) into ByteArrayOutputStream (currentString) with no upper bound. The existing maxEntitySize guard only counts body bytes delivered through the data() callback; header bytes bypass it entirely.
On the non-blocking parse path (VertxResteasyReactiveRequestContext.setReadListener()), there is no wire-byte cap. An attacker can send a chunked Transfer-Encoding: chunked request containing a single MIME part with a multi-gigabyte header value (e.g. X-Boom: <4GB of data>). The parser will faithfully buffer the entire value in memory before any application code runs, leading to OutOfMemoryError.
The attack requires no authentication or valid form field names and works against any endpoint that accepts multipart/form-data.