CVE-2025-66560 (CNNVD-202601-1182)
中文标题:
Quarkus 安全漏洞
英文标题:
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
漏洞描述
中文描述:
Quarkus是Quarkus开源的一个用于编写 Java 应用程序的云原生 (Linux) 容器优先框架。 Quarkus 3.31.0之前版本、3.27.2之前版本和3.20.5之前版本存在安全漏洞，该漏洞源于HTTP层响应处理不当，可能导致工作线程耗尽，引发性能下降或应用完全不可用。
英文描述:
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and 3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the worker thread pool to detect abnormal thread retention early.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| quarkusio | quarkus | >= 3.30.0, < 3.31.0 | - | - |
cpe:2.3:a:quarkusio:quarkus:>=_3.30.0,_<_3.31.0:*:*:*:*:*:*:*
|
| quarkusio | quarkus | >= 3.21.0, < 3.27.2 | - | - |
cpe:2.3:a:quarkusio:quarkus:>=_3.21.0,_<_3.27.2:*:*:*:*:*:*:*
|
| quarkusio | quarkus | < 3.20.5 | - | - |
cpe:2.3:a:quarkusio:quarkus:<_3.20.5:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-66560 |
2026-01-08 02:08:07 | 2026-01-12 02:12:25 |
| NVD | nvd_CVE-2025-66560 |
2026-01-09 03:00:09 | 2026-01-12 02:28:04 |
| CNNVD | cnnvd_CNNVD-202601-1182 |
2026-01-11 06:15:08 | 2026-01-12 02:38:12 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202601-1182
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']