CVE-2025-66560: Quarkus REST Worker Thread Starvation Due to Connection Closure
Summary
CVE-2025-66560: A vulnerability exists in the HTTP layer of Quarkus REST related to response handling. Affects io.quarkus:quarkus-rest across 3 version ranges.
< 3.20.5
>= 3.21.0, < 3.27.2
>= 3.30.0, < 3.31.0
Fixed in 3.20.5, 3.27.2 or 3.31.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quarkus REST is a framework designed for building RESTful web services in Java, providing a lightweight and efficient environment for developing cloud-native applications. It offers features such as reactive programming, dependency injection, and integration with various data sources. However, it is susceptible to a specific vulnerability that can lead to worker thread starvation under certain conditions, impacting application performance and availability.
Vulnerability Detail
A vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. This can lead to exhaustion of available worker threads, resulting in degraded performance or complete unavailability of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.20.53.20.5 -
>= 3.21.0, < 3.27.23.27.2 -
>= 3.30.0, < 3.31.03.31.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For versions without the fix applied, it is recommended to implement a health check that monitors the status and saturation of the worker thread pool. This can help detect abnormal thread retention early and allows operators to take corrective action before the application’s responsiveness is impacted.
Conclusion
The vulnerability CVE-2025-66560 in the Quarkus REST framework poses a risk of worker thread starvation due to improper handling of HTTP connections. It is crucial to update to the patched versions or implement workarounds to mitigate the impact on application performance and availability.
See every vulnerability recorded for io.quarkus:quarkus-rest →
FAQ
CVE-2025-66560 is a vulnerability in the Quarkus REST framework that can lead to worker thread starvation when an HTTP connection is closed while waiting to write a response.
If exploited, this vulnerability can exhaust available worker threads, leading to degraded performance or complete unavailability of your application.
Affected versions include those prior to 3.20.5, between 3.21.0 and 3.27.2, and between 3.30.0 and 3.31.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.quarkus:quarkus-rest.
