CVE-2024-1726: io.quarkus/quarkus-resteasy-reactive

CISO Take

This CVE affects Quarkus RESTEasy Reactive, where JAX-RS security checks for POST, PUT, and PATCH endpoints run after the request body has already been deserialized, letting an attacker who knows a valid endpoint path force the server to burn CPU/memory on unauthenticated or unauthorized requests before rejecting them. For most security teams this sits low on the priority stack: CVSS is medium (5.3, availability-only impact), EPSS puts it in the top 49% most-likely-to-be-exploited bucket (not high), it is not in CISA KEV, CISA's own SSVC decision is TRACK (routine monitoring, not urgent action), and there is no public exploit or Nuclei template in circulation. It matters primarily where Quarkus RESTEasy Reactive backs an internet-facing service with predictable or discoverable API routes. Action: apply the Red Hat-patched Quarkus/RESTEasy Reactive version referenced in RHSA-2024:1662, and in the meantime rate-limit and monitor POST/PUT/PATCH endpoints for anomalous CPU/latency spikes as a compensating control.

Sources: NVD EPSS CISA KEV access.redhat.com ATLAS

What is the risk?

Overall risk is LOW-MEDIUM. The vulnerability requires no authentication or user interaction and has low attack complexity (AV:N/AC:L/PR:N/UI:N), which keeps the theoretical attack surface wide — but the impact is capped at partial availability loss (C:N/I:N/A:L), there's no data exposure or code execution path, and real-world exploitation signals are weak: EPSS is unremarkable (top 49%, not a high-probability bucket), it's absent from CISA KEV, CISA SSVC classifies it as TRACK (lowest urgency tier), and no public exploit code or automated scanner (Nuclei) template exists. This is a routine patch-and-move-on item, not an incident-response trigger.

How does the attack unfold?

Reconnaissance

Attacker identifies or guesses POST/PUT/PATCH endpoint paths on a Quarkus RESTEasy Reactive-based service.

AML.T0049

Exploitation

Attacker sends requests to those endpoints; the server deserializes and processes the payload before running the security/authorization check.

AML.T0034.001

Impact

Repeated requests consume excessive CPU/memory, degrading or denying availability of the underlying service.

AML.T0029

Reconnaissance

Attacker identifies or guesses POST/PUT/PATCH endpoint paths on a Quarkus RESTEasy Reactive-based service.

AML.T0049

Exploitation

Attacker sends requests to those endpoints; the server deserializes and processes the payload before running the security/authorization check.

AML.T0034.001

Impact

Repeated requests consume excessive CPU/memory, degrading or denying availability of the underlying service.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
io.quarkus/quarkus-resteasy-reactive	—	—	No patch
quarkus-resteasy-reactive	—	—	No patch
resteasy-reactive	—	—	No patch

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

What should I do?

1 step

1) Upgrade to the Quarkus/RESTEasy Reactive version fixed per RHSA-2024:1662 (Red Hat) as soon as it fits your patch cycle — this is not an emergency out-of-band patch given the SSVC TRACK rating. 2) Until patched, apply rate limiting / WAF rules on POST, PUT, and PATCH routes, especially any that are internet-facing. 3) Avoid exposing predictable or guessable endpoint paths where feasible; obscurity is not a control but reduces opportunistic scanning cost. 4) Add monitoring/alerting for abnormal CPU or request-processing-time spikes correlated with unauthenticated requests to JAX-RS endpoints — this is the practical detection signal since no exploit signature or Nuclei template exists yet. 5) If Quarkus RESTEasy Reactive underlies an AI model-serving or agent API, treat it the same as any other public-facing service in your patch inventory rather than as an AI-specific risk.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS API AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2024-1726?

This CVE affects Quarkus RESTEasy Reactive, where JAX-RS security checks for POST, PUT, and PATCH endpoints run after the request body has already been deserialized, letting an attacker who knows a valid endpoint path force the server to burn CPU/memory on unauthenticated or unauthorized requests before rejecting them. For most security teams this sits low on the priority stack: CVSS is medium (5.3, availability-only impact), EPSS puts it in the top 49% most-likely-to-be-exploited bucket (not high), it is not in CISA KEV, CISA's own SSVC decision is TRACK (routine monitoring, not urgent action), and there is no public exploit or Nuclei template in circulation. It matters primarily where Quarkus RESTEasy Reactive backs an internet-facing service with predictable or discoverable API routes. Action: apply the Red Hat-patched Quarkus/RESTEasy Reactive version referenced in RHSA-2024:1662, and in the meantime rate-limit and monitor POST/PUT/PATCH endpoints for anomalous CPU/latency spikes as a compensating control.

Is CVE-2024-1726 actively exploited?

No confirmed active exploitation of CVE-2024-1726 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-1726?

1) Upgrade to the Quarkus/RESTEasy Reactive version fixed per RHSA-2024:1662 (Red Hat) as soon as it fits your patch cycle — this is not an emergency out-of-band patch given the SSVC TRACK rating. 2) Until patched, apply rate limiting / WAF rules on POST, PUT, and PATCH routes, especially any that are internet-facing. 3) Avoid exposing predictable or guessable endpoint paths where feasible; obscurity is not a control but reduces opportunistic scanning cost. 4) Add monitoring/alerting for abnormal CPU or request-processing-time spikes correlated with unauthenticated requests to JAX-RS endpoints — this is the practical detection signal since no exploit signature or Nuclei template exists yet. 5) If Quarkus RESTEasy Reactive underlies an AI model-serving or agent API, treat it the same as any other public-facing service in your patch inventory rather than as an AI-specific risk.

What systems are affected by CVE-2024-1726?

This vulnerability affects the following AI/ML architecture patterns: model serving / inference APIs (only if built on Quarkus RESTEasy Reactive), agent orchestration or MLOps backend services (only if built on Quarkus RESTEasy Reactive).

What is the CVSS score for CVE-2024-1726?

CVE-2024-1726 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.72%.

What is the AI security impact?

Affected AI Architectures

model serving / inference APIs (only if built on Quarkus RESTEasy Reactive)agent orchestration or MLOps backend services (only if built on Quarkus RESTEasy Reactive)

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.

Exploitation Scenario

An external attacker fingerprints a Quarkus-based service (e.g., an internal AI model-serving gateway or agent orchestration API built on RESTEasy Reactive) and enumerates or guesses valid POST/PUT/PATCH endpoint paths. Because JAX-RS deserializes and begins processing the request body before the security/authorization check executes, the attacker sends a stream of unauthenticated or unauthorized requests to those paths. Each request consumes meaningful CPU/memory during deserialization and processing before being rejected, and at sufficient volume this degrades or denies availability of the service — for example, an AI inference API or MLOps control endpoint becoming slow or unresponsive for legitimate users during the attack window.

Weaknesses (CWE)

CWE-281 Improper Preservation of Permissions

CWE-281 — Improper Preservation of Permissions: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Source: MITRE CWE corpus.