CVE-2024-1726: Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-25 · updated 2026-08-05
Weakness: CWE-281

Description

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Affected products

Red Hat build of Quarkus: all versions
Red Hat build of Quarkus 3.2.11.Final: all versions — fixed in 3.2.11.Final-redhat-00001

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 3.2.11.Final 3.2.11.Final-redhat-00001. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1726 or the next vulnerability affects your stack