Quarkus: security checks in resteasy reactive may trigger a denial of service
Moderate severity
GitHub Reviewed
Published
Apr 25, 2024
to the GitHub Advisory Database
•
Updated Apr 25, 2024
Package
Affected versions
= 3.8.0.CR1
>= 3.3.0.CR1, < 3.7.4
< 3.2.11.Final
Patched versions
3.8.0
3.7.4
3.2.11.Final
Description
Published by the National Vulnerability Database
Apr 25, 2024
Published to the GitHub Advisory Database
Apr 25, 2024
Reviewed
Apr 25, 2024
Last updated
Apr 25, 2024
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
References