CVE-2025-66560
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In the Quarkus framework before versions 3.31.0, 3.27.2, and 3.20.5, there is a vulnerability in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written chunks to be fully transmitted; if the client connection is dropped, the worker thread is never released and becomes permanently blocked. This can exhaust worker threads, leading to degraded performance or complete unavailability.
Risk Assessment
Repeated connection drops can exhaust the worker thread pool, resulting in performance degradation or complete unavailability of the application. This may impact service continuity.
Recommendation
Update Quarkus to versions 3.31.0, 3.27.2, or 3.20.5 where the vulnerability is patched. As a temporary workaround, implement a health check monitoring worker thread pool status and saturation.
Other vulnerabilities in Quarkus
See all- CVE-2026-87743High
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
- CVE-2026-19625Medium
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, and an optional token introspection cache is enabled, a valid token issued by one OIDC provider can also be used to access an endpoint secured by another OIDC provider.
- CVE-2026-50559High
A vulnerability in Quarkus allows bypassing HTTP path-based authorization policies using encoded semicolons (%3B) and slashes (%2F or %5C).
- CVE-2026-39852High
Quarkus before versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 has a path normalization inconsistency between the security layer and routing. An attacker can bypass authorization policies by appending a semicolon and arbitrary text to the URL (e.g., /api/admin;anything).
- CVE-2024-1726Medium
A flaw in the RESTEasy Reactive implementation in Quarkus causes security checks for some JAX-RS endpoints to be performed after serialization, consuming more processing resources during HTTP request checks. In certain configurations, an attacker knowing POST, PUT, or PATCH request paths can potentially overload vulnerable endpoints, leading to denial of service.
- CVE-2024-1979Low
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- CVE-2023-4853High
A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Original NVD description (English source)
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS