CVE-2025-66560Medium· 5.9▾ SunlitQuarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a respo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.
quarkus < 3.20.5quarkus >= 3.21.0, < 3.27.2quarkus >= 3.30.0, < 3.31.0Upgrade past the affected range:
quarkus 3.31.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6394High· 7.4A flaw was found in Quarkus
CVE-2026-50559High· 7.5Quarkus is a Java framework for building cloud-native applications
CVE-2026-39852High· 8.2Quarkus is a Java framework for building cloud-native applications
CVE-2026-12894High· 8.8A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails
CVE-2026-101750Medium· 4.9mysql: mysql: Denial of Service in Clone Plugin (CVE-2026-101750)
CVE-2026-101761Medium· 5.9mysql: mysql: Denial of Service via security encryption component (CVE-2026-101761)