High [CVE-2026-16308] io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError.

The primary consequence is a denial of service, causing the application to crash. This is an Important flaw in Quarkus REST / RESTEasy Reactive's MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service.

This vulnerability does not require valid form field names or authentication. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-770.

Affected Red Hat products: Cryostat 4 on RHEL 9; Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.4.14; Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.5; Red Hat build of Quarkus 3.27.4.SP3; Red Hat build of Quarkus 3.33.2.SP3; Streams for Apache Kafka 3.2.1; Cryostat 4; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat OpenShift Dev Spaces; streams for Apache Kafka 2.