Description (CNA)
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 3.2.11.Final; affected 3.3.0.CR1 before 3.7.4; affected 3.8.0.CR1; unaffected 3.8.0 |
| Red Hat / Red Hat build of Quarkus 3.2.11.Final | unaffected 3.2.11.Final-redhat-00001 before * |
| Red Hat / Red Hat build of Quarkus | affected |
CWE
CWE-281
References
- https://access.redhat.com/errata/RHSA-2024:1662
- https://access.redhat.com/security/cve/CVE-2024-1726
- https://bugzilla.redhat.com/show_bug.cgi?id=2265158
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.