Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-16308

CVE-2026-16308: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-16308] io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

    CVE-2026-16308Source published Source updated

    IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash. This is an Important flaw in Quarkus REST / RESTEasy Reactive's MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service. This vulnerability does not…

    Affected products in this advisory
    • Red Hat build of Keycloak 26.4.14
    • Red Hat build of Keycloak 26.6.5
    • Red Hat build of Quarkus 3.27.4.SP3
    • Red Hat build of Quarkus 3.33.2.SP3

    5 more entries in the full advisory.

    Source-reported affected versions
    • 3.27.1
    • 3.27.4.SP2
    • 3.33.1
    • 3.33.2.SP2
    Source-reported fixed versions
    • rhbk/keycloak-operator-bundle:26.4.14-1
    • rhbk/keycloak-rhel9:26.4-22
    • rhbk/keycloak-rhel9-operator:26.4-22
    • resteasy-reactive-common-processor

    13 more entries in the full advisory.

    Mitigation guidance
    • Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features