Bug 2530522 (CVE-2026-87742)

Summary:	CVE-2026-87742 quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ant, aschwart, aszczucz, avibelli, bbrownin, bgeorges, boliveir, ccranfor, cescoffi, cmah, dandread, dhanak, dkreling, drichtar, drosa, dsimansk, ewittman, fmongiar, gmalinko, gsmet, gtanzill, janstey, jbuscemi, jmartisk, jnethert, jpechane, kaycoth, kingland, lthon, manderse, mnovotny, mosmerov, mposolda, nipatil, olubyans, ozzy, pantinor, pdelbell, pesilva, pgallagh, pjindal, probinso, rguimara, rkubis, rmartinc, rruss, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, security-response-team, ssilvert, sthorger, tqvarnst, varjain, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-09 06:08:27 UTC

Title: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering
Summary: 

A Denial of Service vulnerability exists in the quarkus-websockets-next extension due to unbounded message buffering.The framework uses an unbounded queue and fails to apply read backpressure on the underlying network socket. An attacker can stream messages over a single connection faster than the application's handler can process them. This rapidly exhausts heap space, causing a java.lang.OutOfMemoryError that crashes the JVM.

Component: io.quarkus:quarkus-vertx-httpCWE: CWE-400, CWE-770
Scoring:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5/10)
Affected versions: 3.27, 3.33

Credit: Michael Read (https://github.com/Michael-JRead)