Red Hat AMQ Broker EUVD-2026-82929

Exploitable only against a Netty-based server whose channel pipeline includes WebSocketServerExtensionHandler and exposes a WebSocket endpoint that negotiates protocol extensions (e.g., permessage-deflate) to untrusted clients. No authentication and no user interaction are required (PR:N/UI:N/AC:L), so any reachable such endpoint is at risk. Exploitation is LIMITED by: the service must actually terminate WebSocket connections through the extension handler (non-WebSocket Netty deployments are unaffected), and impact is confined to availability (memory exhaustion / OutOfMemory) with no data compromise. Real-world exposure depends on whether the affected Red Hat product (AMQ Broker 7, AMQ Clients, Camel, Keycloak/RHBK, Quarkus, Data Grid 8, Fuse 7, EAP 7/8, SSO 7, Apicurio, Debezium) is configured with a network-facing WebSocket listener.

This is a genuine but moderate-priority availability issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates a network-reachable, low-complexity, unauthenticated DoS with no confidentiality or integrity impact - consistent with the description of unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler leading to memory exhaustion. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data provided. The CWE-1035 mapping is not a true weakness type but an OWASP category grouping ('OWASP Top Ten 2017 Category A9') - the real weakness is CWE-770 (allocation of resources without limits) / CWE-400 (uncontrolled resource consumption); this mapping discrepancy should be corrected. Overall this is a real, high-CVSS-but-DoS-only concern: a resource-exhaustion flaw an unauthenticated attacker can trigger against exposed WebSocket endpoints, but its practical severity is bounded by the need for a WebSocket listener that negotiates extensions, and by impact limited to availability. Prioritize where the Netty-based service exposes WebSocket endpoints to untrusted networks; deprioritize internal-only or non-WebSocket deployments.

An unauthenticated remote attacker opens a WebSocket connection to a Netty-based server (e.g., a Red Hat AMQ Broker, Keycloak, or Quarkus service) whose pipeline includes WebSocketServerExtensionHandler, then drives the connection in a way that causes an unbounded internal queue to grow without limit, exhausting JVM heap and denying service to legitimate users. No authentication or user interaction is required (PR:N/UI:N). No public exploit code is identified at time of analysis.