Skip to content
OpenAdvisories
High · 7.5 CVE-2026-87742 EUVD-2026-81675GHSA-g4x4-8j33-p4h3

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

Published Sep 17, 2026 · Updated Oct 9, 2026 · Assigned by redhat

Vendor: Red Hat Product: Exploit Intelligence Product: Red Hat build of Quarkus 3.27.5.SP2 Product: Red Hat build of Quarkus 3.33.3.SP2 Product: Red Hat Enterprise Linux AI (RHEL AI) 3 Platform: Linux

Description

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Quarkus 3.27.5.SP2 — —
Red Hat Red Hat build of Quarkus 3.33.3.SP2 — —
Red Hat Exploit Intelligence — —
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 — —

References