HIGH

CVE-2026-87742

2026-09-17 CVSS v3.1

CVSS

7.5

Description

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.33%

Probability of exploitation in next 30 days

26.6th percentile

References

https://access.redhat.com/security/cve/CVE-2026-87742 https://bugzilla.redhat.com/show_bug.cgi?id=2530522

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE