IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.4.SP2 and 3.33.1 through 3.33.2.SP2 contain a flaw in Quarkus REST that allows a malicious caller to trigger a denial of service by sending multipart MIME requests with unbounded accumulation of part‑header bytes. The vulnerability can cause excessive memory or resource consumption, leading the application to become unresponsive or to crash. This issue is classified under CWE‑770 and carries a CVSS score of 7.5, indicating a high‑severity potential impact on availability for affected deployments.

IBM Enterprise Build of Quarkus, specifically the 3.27.x line up to 3.27.4.SP2 and the 3.33.x line up to 3.33.2.SP2. Systems running any of these versions without the fix are vulnerable.

The flaw can be exploited remotely by any user who can access the exposed Quarkus REST endpoints. The EPSS score is 0.00549, indicating a very low but non‑zero probability of exploitation; the high CVSS score highlights the substantial risk. The vulnerability is not listed in the CISA KEV catalog, but the lack of real‑time exploitation data does not reduce the importance of applying the fix promptly. Attackers can send crafted multipart MIME payloads to exhaust server resources and force a service interruption without requiring elevated privileges.