undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

EUVD-2026-84066

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

quarkus-websockets-next: Denial of Service (OOM) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

CVE-2026-62247: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-87742

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

dev.pathland:pathland-quarkus-starter (0.1.5), io.debezium:debezium-platform-conductor (>=3.7.0.beta2, <=3.7.0.final) +5 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.39.0, <=3.39.4)

io.quarkus:quarkus-websockets-next MAVEN version =3.39.0, =3.7.0.beta2, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.4 - org.apache.camel.quarkus:camel-quarkus-integration-test-vertx-websocket 3.39.0 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...

EUVD-2026-81675

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

com.julien-dubois.bootui:bootui-quarkus (>=1.15.0, <=1.19.0), io.quarkiverse.langchain4j:quarkus-langchain4j-chat-scopes-websocket (>=1.9.1, <=1.14.2) +10 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.33.0.cr1, <=3.33.3.2)

io.quarkus:quarkus-websockets-next MAVEN version =3.33.0.cr1, =1.15.0, =1.9.1, =1.9.1, =1.9.0.cr1, =1.9.0.cr1, =1.9.0.cr1, =1.10.5, =1.10.5, =1.10.5, =1.12.0, =3.33.0.cr1, =3.33.0.cr1, =3.33.3.2 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...

CVE-2026-87742

A flaw in quarkus-websockets-next allows a remote attacker to trigger a Denial of Service by streaming messages over a single connection faster than the application can process them. The root cause is unbounded message buffering combined with a lack of read backpressure , which rapidly exhausts h...

CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot (>=1.5.0.cr1, <=1.8.4), io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot-deployment (>=1.5.0.cr1, <=1.8.4) +5 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.27.0.cr1, <=3.27.5.2)

io.quarkus:quarkus-websockets-next MAVEN version =3.27.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =1.7.0, =1.7.0, =1.7.0, =3.27.0.cr1, =3.27.0.cr1, =3.27.5.2 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...

CVE-2026-87742

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

CVE-2026-87742: Allocation of Resources Without Limits or Throttling

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

PT-2026-94372

Name of the Vulnerable Software and Affected Versions quarkus-websockets-next affected versions not specified Description A flaw allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. This occurs due t...