CVE-2026-87742

Executive Summary

CVE-2026-87742 is an unauthenticated, remote denial-of-service vulnerability in the quarkus-websockets-next extension, where unbounded inbound message buffering combined with the absence of read backpressure allows a single client connection to exhaust JVM heap and trigger java.lang.OutOfMemoryError, crashing the application process. Any internet or network-reachable Quarkus application that exposes quarkus-websockets-next endpoints is at risk, with no privileges or user interaction required. The impact is a full JVM crash (availability loss) with no confidentiality or integrity impact, and no patch is currently available.

Technical Analysis

Quarkus is a Kubernetes-native Java framework (Red Hat-sponsored, upstream open-source project) used to build microservices and cloud applications. The quarkus-websockets-next extension implements the next-generation WebSocket layer for Quarkus applications, providing server endpoints that accept WebSocket connections over a single TCP session.

The vulnerability is classified as CWE-770: Allocation of Resources Without Limits or Throttling, combined with a missing read backpressure mechanism. The mechanism described in the NVD entry is as follows:

1. A WebSocket connection is established between a remote client and a Quarkus server endpoint.
2. The client streams messages over that single connection at a rate exceeding the application's message-processing throughput.
3. Because inbound message buffering is unbounded and the read path applies no backpressure toward the sender, queued inbound messages accumulate in heap memory faster than they are consumed.
4. Continued streaming causes heap consumption to grow without limit until the Java Virtual Machine raises java.lang.OutOfMemoryError.
5. The OOM condition crashes the affected JVM, terminating the application — including all other active WebSocket sessions and any co-hosted services on that JVM.

The essential property is the asymmetry between ingest rate (network-bound, attacker-controlled) and drain rate (application-processing-bound). Backpressure mechanisms (e.g., protocol-level flow control, bounded internal queues, or dropping/refusing reads when a threshold is reached) would normally prevent this. Per the advisory, neither bounded buffering nor read backpressure is present, so a single connection is sufficient — no distributed client set or authentication is required. This makes the attack trivially low-cost for the adversary: AC:L, PR:N, UI:N in the CVSS vector confirm that no special conditions, privileges, or victim interaction are needed.

The buffer exhaustion boundary is determined by the JVM's configured maximum heap (-Xmx). Default heap sizing therefore directly affects time-to-crash; a larger heap delays but does not prevent the crash if streaming continues.

Note on technical granularity: The available advisory does not disclose specific class names, buffer constants, configuration flags, or endpoint paths. The analysis above is restricted to the mechanisms explicitly described — unbounded buffering, lack of read backpressure, and OOM-induced JVM crash — and does not assert implementation details beyond those stated.

CVSS interpretation:

• AV:N — exploitable over the network.
• AC:L — no special attack conditions.
• PR:N — no authentication required.
• UI:N — no user interaction.
• S:U — impact scoped to the vulnerable component.
• C:N/I:N — no confidentiality or integrity impact.
• A:H — high availability impact (full JVM crash).
• Base score 7.5 (High).

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-87742. The attack chain below is inferred at the vulnerability-class level from the NVD description and does not rely on fabricated implementation details.

1. Reconnaissance / target identification. The attacker identifies a network-reachable Quarkus application exposing a WebSocket endpoint implemented via the quarkus-websockets-next extension. Because WebSocket traffic uses HTTP/1.1 or HTTP/2 upgrade semantics, standard service discovery (reverse DNS, Shodan/ZoomEye queries for Quarkus indicators, TLS certificate subject names, or browsing the application's UI for live-updating features) can reveal the presence of WebSocket endpoints.

2. Triggering the flaw class (resource exhaustion via unbounded buffering). The attacker opens a single WebSocket connection to the identified endpoint and begins transmitting messages at a high rate. The critical property is that the volume of data queued inbound exceeds the application's processing rate, and the implementation neither bounds the queue nor throttles the read path. Sustained streaming causes heap consumption to grow monotonically.

3. Payload/execution method (vulnerability-class level). This is not a code-execution or injection vulnerability; the "payload" is simply a continuous, high-rate stream of WebSocket messages on one connection. No malformed frames, no authentication bypass, and no protocol abuse beyond ordinary message transmission are required. The attack succeeds purely through volume and rate, exploiting the missing flow control.

4. Post-exploitation impact. Heap exhaustion culminates in java.lang.OutOfMemoryError, which crashes the JVM. The observable result is abrupt termination of the application process, dropping all active WebSocket sessions and any other services hosted in the same JVM. Under redundant or orchestrated deployments (e.g., Kubernetes), the crash may trigger restarts and potential crash-loop behavior if the attacker reconnects; there is no data theft or persistence component.

Repeatability: Because the mechanism requires no credentials or user interaction, the attacker can reconnect and repeat the attack against whatever instance replaces the crashed one, yielding a sustained availability-degradation campaign rather than a one-time outage.

Impact Assessment

Business impact. The vulnerability is a pure availability threat. Successful exploitation crashes the JVM hosting the Quarkus application, causing service outage for all users and integrations that depend on that instance. Downstream effects include failed transactions, broken real-time features (the very WebSocket functionality the extension provides), and load-amplification on remaining replicas. For applications where quarkus-websockets-next underpins live dashboards, chat, streaming telemetry, or IoT ingestion, the outage is user-visible and immediate.

Affected systems. Any system running a Quarkus application that uses the quarkus-websockets-next extension and exposes a reachable WebSocket endpoint. Exposure is greatest for internet-facing applications; internal-only deployments are still exposed to any client on the same network segment.

Blast radius. Impact is scoped to the affected component per S:U, but in practice a JVM crash can extinguish all services co-hosted in that process. In container-orchestrated environments, the blast radius is bounded by restart policy and replica count — but each replica is independently vulnerable to the same single-connection technique.

CVSS subscores. High availability impact (A:H) with no confidentiality (C:N) or integrity (I:N) impact yields the score of 7.5 (High). The absence of any authentication requirement (PR:N) and lack of attack complexity (AC:L) means exploitation is straightforward for an adversary with network access.

Exploit availability. No public PoC, exploit code, or Nuclei template is known, and CISA KEV does not list this CVE. EPSS has not yet been scored — no exploit-in-the-wild activity is confirmed. However, the low skill floor of rate-based DoS means weaponization is trivial once an endpoint is located.

Detection Guidance

Detection for this vulnerability rests on two signal classes: (a) application/JVM telemetry indicating an OOM crash correlated with elevated inbound WebSocket traffic, and (b) network telemetry indicating abnormally high message rate on individual WebSocket connections.

Sigma Rule

title: Potential quarkus-websockets-next Heap Exhaustion DoS (CVE-2026-87742)
id: 9f2c7d51-3b4a-4e88-9c1f-8a6d2e5b7c40
status: experimental
description: Detects JVM OutOfMemoryError crashes correlated with high-volume WebSocket
  traffic that may indicate exploitation of unbounded message buffering in
  quarkus-websockets-next.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87742
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026-87742
logsource:
  category: application
  product: quarkus
detection:
  selection_oom:
    message|contains:
      - 'java.lang.OutOfMemoryError'
      - 'OutOfMemoryError: Java heap space'
  selection_ws:
    message|contains:
      - 'websockets'
      - 'WebSocket'
  condition: selection_oom and selection_ws
falsepositives:
  - Legitimate load spikes causing OOM under normal operation
  - Misconfigured heap sizing
level: high

YARA Rule

rule CVE_2026_87742_Quarkus_WebSocketsNext_OOM_DoS
{
    meta:
        description = "Detects log/string artifacts associated with heap exhaustion via unbounded WebSocket buffering in quarkus-websockets-next (CVE-2026-87742)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87742"
        date = "2026-01-01"
        severity = "high"

    strings:
        $oom1 = "java.lang.OutOfMemoryError" ascii wide
        $oom2 = "OutOfMemoryError: Java heap space" ascii wide
        $ws1  = "quarkus-websockets-next" ascii wide
        $ws2  = "websockets-next" ascii wide

    condition:
        (uint16(0) == 0x4D5A or true) and
        any of ($oom*) and any of ($ws*)
}

Operator note: The condition has been intentionally relaxed (the artifact need not be a PE binary) so the rule can be applied to captured logs or crash dumps. Tune the file-type guard to your telemetry pipeline.

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-87742 Possible quarkus-websockets-next High-Rate WebSocket DoS (post-upgrade flood)"; flow:established,to_server; content:"GET"; http_method; content:"Upgrade"; http_header; nocase; content:"websocket"; http_header; nocase; threshold:type both, track by_src, count 2000, seconds 10; classtype:attempted-dos; reference:cve,2026-87742; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87742; sid:202687742; rev:1;)

Operator note: Suricata cannot natively parse per-frame WebSocket message rate. This rule detects an anomalous post-upgrade flood at the HTTP-upgrade layer. For per-connection frame-rate visibility, apply equivalent thresholds in a WebSocket-aware proxy (see below).

Elastic Detection

sequence by host.id, process.entity_id with maxspan=30s
  [ process where event.action == "start" and process.name : "java" ]
  [ log where
      (message : "*OutOfMemoryError*" or message : "*Java heap space*")
      and (message : "*websocket*" or message : "*WebSocket*") ]

Operator note: This EQL sequence correlates a JVM process start with a subsequent WebSocket-associated OOM. If your telemetry provides packet/flow data, substitute or augment with a network-rate EQL correlation.

Splunk SPL Query

index=quarkus OR index=app_logs sourcetype=java OR sourcetype=quarkus:log
  ("OutOfMemoryError" OR "Java heap space" OR "java.lang.OutOfMemoryError")
  ("websocket" OR "WebSocket")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as hosts values(source) as sources by host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Operator note: To add a volume-correlation signal, join against ingress byte/connection metrics per socket; a sustained post-upgrade inbound surge immediately preceding the OOM is the strongest exploitation indicator.

Wazuh OSSEC Rule

<group name="quarkus,cve-2026-87742,attack.t1499,">
  <rule id="202687742" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError|Java heap space</field>
    <field name="message">websocket|WebSocket</field>
    <description>CVE-2026-87742: Possible quarkus-websockets-next heap exhaustion DoS (JVM OutOfMemoryError with WebSocket activity).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>denial_of_service,cve_2026_87742,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor fix, no advisory-confirmed fixed version, and no workaround has been published. EPSS has not scored this CVE, and there is no CISA KEV listing. Treat this as an open, unresolved exposure.

1) Immediate mitigations (compensating controls).

• Rate-limit WebSocket ingress at the edge. Enforce per-connection and per-source message/byte-rate limits at a reverse proxy, API gateway, or WAF that understands WebSocket framing. This directly counters the missing read backpressure.
• Bound connection concurrency. Cap simultaneous WebSocket connections per client/IP to reduce the number of independent exhaustion channels.
• Cap per-connection inbound buffering at the proxy layer where configurable, and drop or terminate connections that exceed thresholds.
• Tune the JVM heap defensively. Increasing -Xmx only delays exhaustion and should not be treated as remediation; it may buy restart/orchestration headroom.
• Enable JVM heap-dump-on-OOM for forensics (-XX:+HeapDumpOnOutOfMemoryError) to confirm the exhaustion pattern, but note this writes large files and consumes disk.
• Restrict reachability. Where feasible, place WebSocket endpoints behind authentication/network controls to reduce exposure to anonymous remote clients.

2) Patch / upgrade steps.

• Monitor the Quarkus project security advisories and the upstream quarkus-websockets-next repository for a fixed release. At time of writing, no fixed version is published.
• Once a patch is released, upgrade the quarkus-websockets-next extension (via the Quarkus BOM / dependency management) to the fixed version, rebuild, and redeploy.
• Validate the fix in a staging environment under synthetic high-rate WebSocket load before production rollout, confirming that backpressure/bounded buffering prevents heap growth.

3) Long-term hardening.

• Adopt boundary-level flow control and bounded internal queues for all streaming interfaces (WebSocket, SSE, gRPC streams) as a design standard.
• Instrument inbound message rate and heap headroom as first-class SLIs; alert on sustained divergence between ingest and process rates.
• Include rate-based DoS resilience tests (single-connection floods) in pre-production load testing.
• Run WebSocket workloads with restart policies and horizontal scaling so a single crashed JVM degrades gracefully rather than causing total outage.

References

1. NVD — CVE-2026-87742: https://nvd.nist.gov/vuln/detail/CVE-2026-87742
2. MITRE CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
3. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Quarkus project security advisories (monitor for patch): https://quarkus.io/security/
5. FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/

Exploit-in-the-wild / campaign evidence: None. No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing. No named threat-actor campaigns are associated with CVE-2026-87742 at the time of writing.