{"id":"CVE-2026-87742","published":"2026-09-17T15:16:56.137","lastModified":"2026-09-22T16:18:06.833","description":"A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM).","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:69440","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:69470","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87742","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530522","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}