CVE-2026-16308
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
IBM Enterprise Build of Quarkus REST has a vulnerability due to unbounded accumulation of multipart MIME part-header bytes, potentially leading to resource exhaustion.
Risk Assessment
A remote attacker can cause a denial of service (DoS) by sending a specially crafted request, potentially disrupting application availability.
Recommendation
Upgrade to a patched version of Quarkus or implement request size limits for multipart requests.
Other vulnerabilities in IBM Enterprise Build of Quarkus
See all- CVE-2026-77874High
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2026-19651High
IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.
Original NVD description (English source)
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS