A Denial of Service vulnerability exists in the quarkus-websockets-next extension due to unbounded message buffering.
The framework uses an unbounded queue and fails to apply read backpressure on the underlying network socket.
An attacker can stream messages over a single connection faster than the application's handler can process them.
This rapidly exhausts heap space, causing a java.lang.OutOfMemoryError that crashes the JVM.

Impact

Any application using the io.quarkus:quarkus-websockets-next extension is impacted.

The WebSocket endpoint processes inbound messages using an unbounded MPSC queue without applying read backpressure to the underlying socket. Because no concurrency limit or queue capacity is applied to inbound messages, an attacker can stream messages (e.g., just under the 256 KB default size limit) over a single connection faster than the application's handler can drain them. This causes the messages to accumulate in memory without bound, rapidly leading to a java.lang.OutOfMemoryError and crashing the JVM.

If the WebSocket endpoint is unsecured (no authentication required), an unauthenticated remote attacker can trigger this crash trivially.

Workarounds

Until a patch is available, organizations can mitigate this by applying controls outside the application:

• Reverse Proxy / WAF Rate Limiting: Enforce strict rate limiting on WebSocket frames/messages at your reverse proxy (e.g., Nginx, HAProxy, Envoy) to prevent a single connection from flooding the endpoint.
• Require Authentication: If the endpoint is currently unsecured, requiring authentication will limit the attack surface to authenticated users only (though a malicious authenticated user could still trigger the DoS).

References

• CWE-770: Allocation of Resources Without Limits or Throttling
• CWE-400: Uncontrolled Resource Consumption