Executive brief
Red Hat Quarkus WebSockets Next is a Java framework component that handles WebSocket connections for real-time communication in applications. An attacker can crash the application by sending messages faster than they can be processed, overwhelming server memory and forcing an out-of-memory failure that takes down the entire Java process.
Technical details
The vulnerability is a denial-of-service flaw in the quarkus-websockets-next module caused by unbounded message buffering and the absence of read backpressure mechanisms. An unauthenticated remote attacker can stream WebSocket messages over a single connection at a rate faster than the application processes them, causing messages to accumulate indefinitely in memory. This rapid heap exhaustion triggers a java.lang.OutOfMemoryError that crashes the JVM. The attack requires only network reachability to a WebSocket endpoint; no authentication or special preconditions are needed.
Affected products
- Red Hat Quarkus 3.33.3.SP2 and earlier
Timeline
- 2026-09-17: disclosed
- 2026-09-21: patched: Fixed in Red Hat build of Quarkus 3.33.3.SP2