Denial of Service Vulnerability in Quarkus WebSockets Next

A vulnerability exists in the quarkus-websockets-next component of the Red Hat Quarkus framework, identified as CVE-2026-87742. This issue stems from the lack of read backpressure and the implementation of unbounded message buffering within the WebSocket handling logic. A remote, unauthenticated attacker can exploit this flaw by flooding a single WebSocket connection with high-frequency messages. Because the application fails to regulate the data ingress rate, the incoming messages accumulate in the system's memory heap. This rapid, uncontrolled allocation of memory leads to a java.lang.OutOfMemoryError, ultimately forcing the JVM to crash and resulting in a complete Denial of Service for the affected service.

Impact

Successful exploitation results in the immediate unavailability of the application due to a JVM crash. This Denial of Service vulnerability impacts any service utilizing the vulnerable quarkus-websockets-next extension. Depending on the service architecture, this may lead to significant operational disruption for organizations relying on the affected Quarkus-based applications.

Recommendation

1. Identify all applications currently utilizing the quarkus-websockets-next extension within the environment.
2. Monitor application logs and system resource telemetry for sudden, high-frequency WebSocket traffic volume and recurring JVM heap usage spikes.
3. Consult Red Hat security advisories for the specific patched version of Quarkus and prioritize applying updates to all vulnerable nodes.