CVE-2026-87742 Red Hat CVE debrief

Who should care

Defenders of Red Hat build of Quarkus 3.27.5.SP2 and 3.33.3.SP2 deployments should assess exposure and prioritize remediation due to the high CVSS score of 7.5 and the potential for DoS attacks.

Why it matters

CVE-2026-87742 is a high-severity vulnerability in quarkus-websockets-next that allows remote attackers to cause a Denial of Service (DoS) via unbounded message buffering. Defenders of Red Hat build of Quarkus 3.27.5.SP2 and 3.33.3.SP2 should verify exposure, assess heap space exhaustion risk, and prioritize vendor remediation.

• Heap space exhaustion risk requires verification
• Potential for Denial of Service (DoS) attacks
• Need for vendor remediation and patching
• Importance of monitoring for unbounded message buffering attempts

Technical summary

The quarkus-websockets-next component is vulnerable to a Denial of Service (DoS) attack due to unbounded message buffering. A remote attacker can stream messages over a single connection faster than the application can process them, causing a rapid exhaustion of heap space and leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM). This issue affects Red Hat build of Quarkus 3.27.5.SP2 and 3.33.3.SP2 deployments. Defenders should prioritize verifying exposure, assessing heap space exhaustion risk, and applying vendor remediation.

Defensive priority

Defenders should prioritize verifying exposure of Red Hat build of Quarkus 3.27.5.SP2 and 3.33.3.SP2, assessing heap space exhaustion risk, and applying vendor remediation.

Recommended defensive actions

• Verify exposure of Red Hat build of Quarkus 3.27.5.SP2 and 3.33.3.SP2
• Assess heap space exhaustion risk
• Apply vendor remediation (RHSA-2026:69440, RHSA-2026:69470)
• Monitor for unbounded message buffering attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official metadata. Red Hat provides affected product information and advisories (RHSA-2026:69440, RHSA-2026:69470). The vulnerability affects Red Hat build of Quarkus 3.27.5.SP2 and 3.33.3.SP2. Defenders should verify exposure, assess heap space exhaustion risk, and prioritize vendor remediation. The source item detail and CVE Program record provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.