What’s Vulnerable › Vulnerabilities

CVE-2026-87742: Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-09
• Weakness: CWE-770

Description

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

Affected products

• Red Hat Exploit Intelligence: all versions
• Red Hat Enterprise Linux AI (RHEL AI) 3: all versions

References

• https://access.redhat.com/errata/RHSA-2026:69440
• https://access.redhat.com/errata/RHSA-2026:69470
• https://access.redhat.com/security/cve/CVE-2026-87742
• https://bugzilla.redhat.com/show_bug.cgi?id=2530522

Get alerted when CVE-2026-87742 or the next vulnerability affects your stack