CVE-2025-1634highCWE-401

CVE-2025-1634: high-severity vulnerability in quarkus-resteasy

Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout

Published · Updated

Follow this CVE+ Monitor Red Hat build of Quarkus+ Monitor streams for Apache Kafka

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.0%
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
quarkus-resteasyRed Hat · Red Hat Build of Apache Camel 4.8 for Quarkus 3.15Red Hat · Red Hat build of QuarkusRed Hat · Red Hat build of Quarkus 3.15.3.SP1Red Hat · Red Hat build of Quarkus 3.8.6.SP3Red Hat · Streams for Apache Kafka 2.9.1Red Hat · Streams for Apache Kafka 3.0.0Red Hat · Streams for Apache Kafka 3.1.0
Related CVEs — quarkus-resteasy

In the same product, most dangerous first.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.7%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2023-4853HIGHQuarkus: http security policy bypassEPSS 2.3%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%