Bug 2418794 (CVE-2025-66560)

Summary:	CVE-2025-66560 io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, adamevin, anstephe, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, caswilli, ccranfor, chfoley, clement.escoffier, cmah, dandread, darran.lofthouse, dkreling, dosoudil, eaguilar, ebaron, gsmet, istudens, ivassile, iweiss, janstey, jmartisk, jolong, jpechane, jsamir, kaycoth, lthon, manderse, mosmerov, msvehla, nwallace, olubyans, pberan, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rruss, rstancel, rsvoboda, sbiarozk, security-response-team, smaestri, sthirugn, swoodman, tom.jenkinson, tqvarnst, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Quarkus REST HTTP layer. This vulnerability allows remote attackers to cause an application level denial of service by repeatedly dropping client connections while response chunks are being transmitted, leading to worker thread exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-01-22

Description OSIDB Bzimport 2025-12-04 13:16:57 UTC

The issue affects the HTTP layer of Quarkus REST. When writing a response, the framework waits for previously sent response chunks to be fully transmitted before continuing. If the client connection is dropped during this wait, the associated worker thread is never released and remains permanently blocked. Under repeated occurrences, this can exhaust the worker thread pool, resulting in severe performance degradation or complete application unavailability.