CVE-2025-1634highCWE-401

CVE-2025-1634: fallo de gravedad alta en quarkus-resteasy

Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat build of Quarkus+ Monitorear streams for Apache Kafka

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.0%
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
quarkus-resteasyRed Hat · Red Hat Build of Apache Camel 4.8 for Quarkus 3.15Red Hat · Red Hat build of QuarkusRed Hat · Red Hat build of Quarkus 3.15.3.SP1Red Hat · Red Hat build of Quarkus 3.8.6.SP3Red Hat · Streams for Apache Kafka 2.9.1Red Hat · Streams for Apache Kafka 3.0.0Red Hat · Streams for Apache Kafka 3.1.0
CVEs relacionadas — quarkus-resteasy

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.7%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2023-4853HIGHQuarkus: http security policy bypassEPSS 2.3%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%