Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by redhat

CVE-2026-87742Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

High 7.5

In plain English

A high-severity resource allocation without limits in Exploit Intelligence from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Quarkus 3.27.5.SP2 see references
Red Hat Red Hat build of Quarkus 3.33.3.SP2 see references
Red Hat Exploit Intelligence see references
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 see references
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 see references
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 see references
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 see references

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References