7.5
High
CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
Description
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Exploit Intelligence | Versions not published | |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat build of Quarkus | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat build of Quarkus 3.27.6.redhat 3.27 | earliest → < 3.27.6.redhat-00004 | 3.27.6.redhat-00004 |
| Red Hat build of Quarkus 3.33.4.redhat 3.33 | earliest → < 3.33.4.redhat-00004 | 3.33.4.redhat-00004 |
| Red Hat Build of Apache Camel 3.33.4.redhat 3.33 | earliest → < 3.33.4.redhat-00004 | 3.33.4.redhat-00004 |
References
- RHSA-2026:83082 access.redhat.com
- RHSA-2026:83520 access.redhat.com
- RHSA-2026:83670 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2537502 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Exploit Intelligence
The 29 CVEs of Exploit Intelligence →
CVE-2026-121837
Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
4.3
Medium
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
High
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a…
3.3
Low
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache
9.1
Critical