High severity · published Jan 7, 2026
CVE-2025-66560
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QU
Quarkus · Quarkus
before 3.20.5; 3.21.0 before 3.27.2; 3.30.0 before 3.31.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66560
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-66560
Vendor Advisory
https://github.com/quarkusio/quarkus/security/advisories/GHSA-5rfx-cp42-p624
More from Quarkus
9.8
CVE-2023-6267
A flaw was found in the json payload
9.8
CVE-2022-4116
A vulnerability was found in quarkus
9.8
CVE-2022-2466
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior
9.8
CVE-2022-21724
pgjdbc is the offical PostgreSQL JDBC Driver
9.1
CVE-2024-12225
A vulnerability was found in Quarkus in the quarkus-security-webauthn module
