High severity · published Jan 7, 2026
CVE-2025-66560
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
quarkus · quarkusio
>= 3.30.0, < 3.31.0; >= 3.21.0, < 3.27.2; < 3.20.5 · source: vendor, NVD
Affected product
QU
quarkus
quarkusio
More from quarkus
8.2
CVE-2026-39852
Quarkus authorization bypass via semicolon path normalization inconsistency
7.5
CVE-2026-50559
Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
6.4
CVE-2025-49574
Quarkus potential data leak when duplicating a duplicated context