{"id":"CVE-2026-87742","revision":"9a425d21b90849f1b6b2d813fc9f847d","records":[{"revision":"9a425d21b90849f1b6b2d813fc9f847d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-87742","aliases":[],"title":"Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering","description":"A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).","state":0,"publishedAt":"2026-09-17T14:57:44.414+00:00","modifiedAt":"2026-10-09T15:37:02.18+00:00","affected":[{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"quarkus-websockets-next","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Quarkus 3.27.5.SP2\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"quarkus-websockets-next\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:quarkus:3.27::el8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"quarkus-websockets-next","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Quarkus 3.33.3.SP2\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"quarkus-websockets-next\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:quarkus:3.33::el8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"exploit-intelligence/agent-client-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Exploit Intelligence\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"exploit-intelligence/agent-client-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:exploit_intelligence:0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhelai3/bootc-cuda-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhelai3/bootc-cuda-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux_ai:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhelai3/bootc-gaudi-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhelai3/bootc-gaudi-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux_ai:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhelai3/bootc-rocm-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhelai3/bootc-rocm-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux_ai:3\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rhelai3/disk-image-cuda-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rhelai3/disk-image-cuda-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux_ai:3\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/security/cve/CVE-2026-87742","https://bugzilla.redhat.com/show_bug.cgi?id=2530522"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-87742","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-87742","identifiers":["CVE-2026-87742"]},"retained":false,"historicalAffected":[]}],"coverage":[]}