CVE-2025-66560: 
Java vulnerability analysis and mitigation

CVE-2025-66560 is a worker thread starvation vulnerability in the HTTP layer of Quarkus REST (io.quarkus:quarkus-rest) that can lead to denial of service. When a response is being written and the client connection is dropped, the associated worker thread becomes permanently blocked and is never released. Repeated occurrences exhaust the available worker thread pool, causing degraded performance or complete application unavailability. Affected versions include all releases before 3.20.5, versions 3.21.0 through 3.27.1, and versions 3.30.0 through 3.30.x (before 3.31.0). The vulnerability was disclosed on January 7, 2026, and carries a CVSS v3.1 score of 5.9 (Medium) per the CNA (GitHub), or 7.5 (High) per NVD enrichment (Github Advisory, Quarkus Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In Quarkus REST's HTTP response handling, the framework uses a blocking wait mechanism to ensure previously written response chunks are fully transmitted before writing the next chunk. If the client disconnects during this wait, the worker thread remains blocked indefinitely with no timeout or cleanup mechanism to release it. An unauthenticated remote attacker can trigger this condition by repeatedly initiating HTTP connections, causing response transmission to begin, and then abruptly dropping the connection — requiring no special privileges or user interaction. The vulnerability was reported by Shaswata Jash of Nokia (Github Advisory, Quarkus Advisory).

The sole impact of this vulnerability is on availability — there is no confidentiality or integrity impact. By exhausting the worker thread pool, an attacker can render the Quarkus REST application completely unresponsive, effectively causing a denial of service. Downstream IBM products that embed Quarkus (including IBM Event Automation, IBM Observability with Instana OnPrem, IBM Automation Decision Services, and IBM watsonx Orchestrate) are also affected, broadening the potential impact across enterprise deployments (Github Advisory, IBM Event Processing, IBM Instana).

1. Reconnaissance: Identify internet-facing or network-accessible Quarkus REST applications running affected versions (before 3.20.5, 3.21.0–3.27.1, or 3.30.0–3.30.x) using service fingerprinting tools or banner analysis.
2. Initiate HTTP request: Send an HTTP request to any endpoint served by the Quarkus REST layer that returns a non-trivial response (e.g., a streaming or chunked response), causing the server to begin writing response chunks.
3. Drop the connection: Abruptly terminate the TCP connection (e.g., via RST packet or by closing the socket) while the server is in the process of transmitting response data, specifically during the inter-chunk wait period.
4. Repeat at scale: Automate and repeat steps 2–3 rapidly across multiple concurrent connections to exhaust the worker thread pool. Each dropped connection permanently blocks one worker thread.
5. Achieve DoS: Once all worker threads are exhausted, the application becomes unable to process new requests, resulting in complete unavailability (Github Advisory, Quarkus Advisory).

• Logs: Quarkus application logs showing a growing number of threads in a blocked/waiting state; health check endpoints returning degraded or DOWN status for thread pool saturation.
• Metrics/Monitoring: Worker thread pool utilization approaching 100% with no corresponding increase in legitimate traffic; thread dump analysis revealing multiple threads permanently blocked waiting on HTTP write operations.
• Network: High volume of short-lived TCP connections to the Quarkus REST service that are abruptly terminated (RST packets) shortly after the server begins sending response data.
• Application Behavior: Sudden increase in request timeouts or connection refused errors from the Quarkus application despite the process remaining alive; JVM thread count growing without bound.

Upgrade to one of the patched versions of io.quarkus:quarkus-rest: 3.20.5, 3.27.2, or 3.31.0, depending on the release branch in use. For deployments that cannot immediately upgrade, implement a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early, enabling operators to restart or remediate the service before full unavailability occurs. IBM product users should apply the relevant vendor-specific patches for IBM Event Automation, IBM Observability with Instana OnPrem, IBM Automation Decision Services, and IBM watsonx Orchestrate as they become available (Github Advisory, IBM Event Processing, IBM Instana, IBM ADS).

The vulnerability was reported by Shaswata Jash of Nokia and published by Quarkus maintainer cescoffier on January 7, 2026. Red Hat issued security errata (RHSA-2026:1965 and RHSA-2026:1899) addressing this CVE in their product lines. Keycloak 26.5.2 also incorporated a fix, as Keycloak depends on Quarkus. Community reaction has been limited given the moderate severity and lack of active exploitation (Quarkus Advisory, Red Hat Errata).