Detections
Analytics
SCA: security update for io.quarkus:quarkus-rest (GHSA-5rfx-cp42-p624)
high Tenable Cloud Security Plugin ID 436601
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to
versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to
response handling. When a response is being written, the framework waits for previously written response
chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting
period, the associated worker thread is never released and becomes permanently blocked. Under sustained or
repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or
complete unavailability of the application. This issue has been patched in versions 3.31.0, 3.27.2, and
3.20.5. A workaround involves implementing a health check that monitors the status and saturation of the
worker thread pool to detect abnormal thread retention early. (CVE-2025-66560)
See Also
Plugin Details
Severity: High
ID: 436601
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 1/7/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2025-66560
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 1/7/2026
Vulnerability Publication Date: 1/7/2026
Reference Information
CVE: CVE-2025-66560
cwe: CWE-770