CVE-2025-2240highCWE-1325

CVE-2025-2240: high-severity vulnerability in smallrye-fault-tolerance-core

Smallrye-fault-tolerance: smallrye fault tolerance

Published · Updated

Follow this CVE+ Monitor Red Hat JBoss Enterprise Application Platform Expansion Pack+ Monitor Red Hat JBoss Enterprise Application Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 1.2%
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
smallrye-fault-tolerance-coreRed Hat · Red Hat build of Apache Camel 4.8.5 for Spring BootRed Hat · Red Hat Build of Apache Camel 4.8 for Quarkus 3.15Red Hat · Red Hat build of Apicurio Registry 2Red Hat · Red Hat build of Apicurio Registry 3Red Hat · Red Hat build of QuarkusRed Hat · Red Hat build of Quarkus 3.15.4Red Hat · Red Hat Fuse 7Red Hat · Red Hat Integration Camel K 1Red Hat · Red Hat JBoss Enterprise Application Platform 7Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack
Related CVEs — smallrye-fault-tolerance-core

In the same product, most dangerous first.

CVE-2025-1634HIGHIo.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeoutEPSS 1.0%CVE-2025-1247HIGHIo.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instanceEPSS 0.8%