Read the docs
TI-2025-40971 Aliases CVE-2025-66560GHSA-5rfx-cp42-p624

Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

Priority LOW 33CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Partial quarkus (quarkusio): 3.31.0, 3.27.2, 3.20.5io.quarkus:quarkus-rest (Maven): 3.20.5, 3.27.2, 3.31.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quarkusioquarkus3.30.0 to before 3.31.0; 3.21.0 to before 3.27.2; before 3.20.53.31.0, 3.27.2, 3.20.5Patch availableCNA
—io.quarkus:quarkus-rest (Maven)before 3.20.53.20.5Patch availableGHSA-5rfx-cp42-p624
—io.quarkus:quarkus-rest (Maven)3.21.0 to before 3.27.23.27.2Patch availableGHSA-5rfx-cp42-p624
—io.quarkus:quarkus-rest (Maven)3.30.0 to before 3.31.03.31.0Patch availableGHSA-5rfx-cp42-p624
  • quarkus Vendorquarkusio Affected 3.30.0 to before 3.31.0; 3.21.0 to before 3.27.2; before 3.20.5 Fixed in 3.31.0, 3.27.2, 3.20.5 Patch available CNA
  • io.quarkus:quarkus-rest (Maven) Vendor— Affected before 3.20.5 Fixed in 3.20.5 Patch available GHSA-5rfx-cp42-p624
  • io.quarkus:quarkus-rest (Maven) Vendor— Affected 3.21.0 to before 3.27.2 Fixed in 3.27.2 Patch available GHSA-5rfx-cp42-p624
  • io.quarkus:quarkus-rest (Maven) Vendor— Affected 3.30.0 to before 3.31.0 Fixed in 3.31.0 Patch available GHSA-5rfx-cp42-p624

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 3.20.5; 3.21.0 to before 3.27.2; 3.30.0 to before 3.31.0Vulnerablequarkusio
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 3.20.5; 3.21.0 to before 3.27.2; 3.30.0 to before 3.31.0 Vulnerable ·quarkusio

Remediation

  • Fix · CNA quarkus (quarkusio) Fixed in 3.31.0, 3.27.2, 3.20.5
  • Fix · GHSA-5rfx-cp42-p624 io.quarkus:quarkus-rest (Maven) Fixed in 3.20.5 Advisory →
  • Fix · GHSA-5rfx-cp42-p624 io.quarkus:quarkus-rest (Maven) Fixed in 3.27.2 Advisory →
  • Fix · GHSA-5rfx-cp42-p624 io.quarkus:quarkus-rest (Maven) Fixed in 3.31.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:1965 Released 2026-02-05 · Red Hat rating Moderate
    Red Hat build of Quarkus 3.27.2 release and security update
    • Red Hat build of Quarkus 3.27.2.redhat com.ongres.scram.scram-common-3.2.0.redhat-00001.jar, io.netty.netty-codec-http-4.1.130.Final-redhat-00001.jar, io.quarkus.quarkus-rest-3.27.2.redhat-00001.jar +1
  • RHSA-2026:1899 Released 2026-02-05 · Red Hat rating Moderate
    Red Hat build of Quarkus 3.20.5 release and security update
    • Red Hat build of Quarkus 3.20.5.redhat com.ongres.scram.scram-common-3.2.0.redhat-00001.jar, io.netty.netty-codec-http-4.1.130.Final-redhat-00001.jar, io.quarkus.quarkus-rest-3.20.5.redhat-00001.jar

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat build of Debezium 3AffectedNo fix yet: Fix deferred
streams for Apache Kafka 2AffectedNo fix yet: Fix deferred
streams for Apache Kafka 3AffectedNo fix yet: Fix deferred
Red Hat build of Quarkus 3.20.5.redhatFixed RHSA-2026:1899
Red Hat build of Quarkus 3.27.2.redhatFixed RHSA-2026:1965
Not affected: 2 products
  • Red Hat build of Quarkus 3.20.5.redhat
  • Red Hat build of Quarkus 3.27.2.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66560
  2. 2026-10-03 Alias added: GHSA-5rfx-cp42-p624
  3. 2026-10-20 Fix available: Red Hat build of Quarkus 3.20.5.redhat, Red Hat build of Quarkus 3.27.2.redhat · Red Hat

References

Advisory 2

Other 1

  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2026-37281 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2020-15666 XML external entity injection in jackson-databind CVSS 3.1HIGH 7.5
  • TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
  • TI-2021-08126 block repositories using http by default CVSS 3.1CRITICAL 9.1
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences