{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-16308",
        "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "state": "PUBLISHED",
        "assignerShortName": "ibm",
        "dateReserved": "2026-07-20T14:31:00.798Z",
        "datePublished": "2026-07-30T14:04:42.806Z",
        "dateUpdated": "2026-07-30T16:20:01.475Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
                "shortName": "ibm",
                "dateUpdated": "2026-07-30T14:04:42.806Z"
            },
            "title": "IBM Enterprise Build of Quarkus is affected by a DoS vulnerability",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-770",
                            "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "IBM",
                    "product": "Enterprise Build of Quarkus",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "3.27.1",
                            "lessThanOrEqual": "3.27.4.SP2",
                            "versionType": "semver"
                        },
                        {
                            "status": "affected",
                            "version": "3.33.1",
                            "lessThanOrEqual": "3.33.2.SP2",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.4.sp2:sp2:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.2.sp2:sp2:*:*:*:*:*:*"
                    ]
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.</p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://www.ibm.com/support/pages/node/7281904",
                    "tags": [
                        "vendor-advisory",
                        "patch"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "scope": "UNCHANGED",
                        "confidentialityImpact": "NONE",
                        "integrityImpact": "NONE",
                        "availabilityImpact": "HIGH",
                        "baseSeverity": "HIGH",
                        "baseScore": 7.5,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                    }
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "value": "The issues are addressed in IBM Enterprise Build of Quarkus 3.27.4.SP3 and 3.33.2.SP3. To update your project to IBM Enterprise Build of Quarkus 3.27.4.SP3 or 3.33.2.SP3, follow the instructions in the  product documentation https://www.ibm.com/docs/en/quarkus/3.27.x .",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p>The issues are addressed in IBM Enterprise Build of Quarkus 3.27.4.SP3 and 3.33.2.SP3. To update your project to IBM Enterprise Build of Quarkus 3.27.4.SP3 or 3.33.2.SP3, follow the instructions in the <a href=\"https://www.ibm.com/docs/en/quarkus/3.27.x?topic=overview-learn-whats-new-in-327#proc_updating-quarkus-maven\" rel=\"nofollow\">product documentation</a>.</p>"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Mike Read (JP Morgan)",
                    "type": "finder"
                }
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-07-30T16:19:53.535229Z",
                                "id": "CVE-2026-16308",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-07-30T16:20:01.475Z"
                }
            }
        ]
    }
}