Today we would like to announce the release of RESTEasy 6.2.19.Final and RESTEasy 7.0.5.Final. Both releases address two security vulnerabilities, and we would encourage all users to upgrade.

The first is RESTEASY-3793, a decompression bomb denial of service in IIOImageProvider tracked as CVE-2026-89059 (CVSS 7.5, High). An image/* request body was decoded with no bound on the size of the resulting raster, so a small image declaring enormous dimensions could exhaust the heap. This release adds a dev.resteasy.image.threshold configuration property which estimates the size of the decoded image, including its thumbnails, and rejects anything larger with a 400 before decoding it. The default is 200MB and a value of -1 disables the validation. Note this is the estimated size of the decoded image in memory, not the size of the request body, and it is a per-image estimate rather than a limit on the memory used across concurrent requests. While it is ranked High, the vulnerability only affects endpoints which accept a javax.imageio.IIOImage entity parameter, for example a POST or PUT resource method reading an image/* request body.

The second is RESTEASY-3796, a CORS misconfiguration in CorsFilter tracked as CVE-2026-89058 (CVSS 7.4, High). When "*" was added to the allowed origins, the filter reflected the concrete request Origin back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This is the misconfiguration the CORS specification forbids for *, and it allowed any site to perform credentialed cross-origin reads of authenticated responses. While it is ranked High, the vulnerability only affects applications which register the CorsFilter and add "*" to the allowed origins. Applications which list their allowed origins explicitly are not affected.

Fixing this required two changes in CorsFilter which are worth calling out, as both change the default behavior. The default value of allowCredentials is now false rather than true. In addition, when the allowed origins contain "*", the filter now returns a literal * in Access-Control-Allow-Origin, does not add Vary: Origin and never sends Access-Control-Allow-Credentials. A warning is logged the first time credentials are ignored for a wildcard origin. Note the allowCredentials default applies to every user of the CorsFilter, including those who were never vulnerable, so if you relied on it being true you will now need to set it explicitly. If you need credentials on cross-origin requests, list the origins you trust rather than using a wildcard.