CVE-2026-16308 in Enterprise Build of Quarkus
Summary
by MITRE • 07/30/2026
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
This vulnerability affects IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2, specifically within the REST functionality that processes multipart MIME requests. The flaw stems from insufficient validation of multipart request headers, allowing an attacker to submit maliciously crafted requests that cause unbounded accumulation of header bytes in memory. This represents a classic resource exhaustion attack vector where the application fails to properly limit or track the size of incoming multipart data, particularly focusing on part-header bytes that accumulate during processing.
The technical implementation of this vulnerability involves the Quarkus REST framework's handling of multipart form data where it processes each MIME part header without enforcing reasonable limits on header byte accumulation. When an attacker submits multiple malformed multipart requests with excessive header content, the application continues to store and process these headers without proper bounds checking, leading to memory consumption that grows without limit until system resources are exhausted. This behavior aligns with CWE-400, which categorizes unchecked resource consumption as a vulnerability where applications fail to limit resource usage, and can be classified under the broader category of denial of service attacks.
The operational impact of this vulnerability is significant for systems relying on Quarkus REST endpoints that accept multipart data from untrusted sources. An attacker could exploit this weakness by sending specially crafted requests that gradually consume available memory resources until the application becomes unresponsive or crashes entirely. This type of attack would typically be classified under ATT&CK technique T1499.004, which involves network denial of service attacks through resource exhaustion. The vulnerability particularly affects environments where Quarkus applications process file uploads, form submissions, or any REST operations that handle multipart content from external clients.
Organizations should immediately apply the latest patches provided by IBM for the affected Quarkus versions to address this memory exhaustion vulnerability. Additionally, implementing request size limits and monitoring for unusual memory consumption patterns can serve as effective mitigations. Network-level controls such as rate limiting and connection tracking can help detect and prevent exploitation attempts. System administrators should also consider implementing memory constraints and resource monitoring tools to identify potential abuse of this vulnerability before it causes service disruption. The fix typically involves adding proper bounds checking for multipart header processing within the Quarkus REST framework, ensuring that header bytes are limited to reasonable thresholds based on expected application requirements.