Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-17T13:10:22 quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

This is an Important denial of service vulnerability in the `quarkus-websockets-next` extension of Red Hat Build of Quarkus. The flaw allows a remote attacker to exhaust application heap memory by sending a rapid stream of messages over a single WebSocket connection, leading to an OutOfMemoryError and subsequent JVM crash. This can result in service unavailability for affected applications. Red Hat would like to thank Michael Read ((https://github.com/Michael-JRead)) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Exploit Intelligence Affected exploit-intelligence/agent-client-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-87742 https://nvd.nist.gov/vuln/detail/CVE-2026-87742