CVE-2026-87742: Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).
Other sources
Title: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering Summary:
A Denial of Service vulnerability exists in the quarkus-websockets-next extension due to unbounded message buffering.The framework uses an unbounded queue and fails to apply read backpressure on the underlying network socket. An attacker can stream messages over a single connection faster than the application's handler can process them. This rapidly exhausts heap space, causing a java.lang.OutOfMemoryError that crashes the JVM.
Component: io.quarkus:quarkus-vertx-httpCWE: CWE-400, CWE-770 Scoring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5/10) Affected versions: 3.27, 3.33
Credit: Michael Read (https://github.com/Michael-JRead)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.quarkus:quarkus-websockets-nextto a version that resolves this vulnerability.Fixed in 3.27 - Upgrade
Upgrade
io.quarkus:quarkus-websockets-nextto a version that resolves this vulnerability.Fixed in 3.33
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker that can establish a WebSocket connection to an affected application can exploit it. No authentication or user interaction is required.
What conditions are required for exploitation?
The attacker must send messages over a single connection faster than the application’s handler can process them. The unbounded buffering and absence of read backpressure allow queued messages to consume heap memory.
What is the operational impact?
Heap exhaustion triggers a java.lang.OutOfMemoryError and can crash the JVM, causing denial of service. The provided scoring indicates no direct confidentiality or integrity impact.
Which versions are identified as affected?
The affected versions listed are 3.27 and 3.33.