CVE-2025-1634highCWE-401

CVE-2025-1634: falha de alta gravidade em quarkus-resteasy

Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat build of Quarkus+ Monitorar streams for Apache Kafka

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.0%
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
quarkus-resteasyRed Hat · Red Hat Build of Apache Camel 4.8 for Quarkus 3.15Red Hat · Red Hat build of QuarkusRed Hat · Red Hat build of Quarkus 3.15.3.SP1Red Hat · Red Hat build of Quarkus 3.8.6.SP3Red Hat · Streams for Apache Kafka 2.9.1Red Hat · Streams for Apache Kafka 3.0.0Red Hat · Streams for Apache Kafka 3.1.0
CVEs relacionadas — quarkus-resteasy

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1635HIGHUndertow: out-of-memory error after several closed connections with wildfly-http-client protocolEPSS 4.6%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2023-3223HIGHUndertow: outofmemoryerror due to @multipartconfig handlingEPSS 2.7%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%CVE-2023-4853HIGHQuarkus: http security policy bypassEPSS 2.3%CVE-2024-3653MEDIUMUndertow: learningpushhandler can lead to remote memory dos attacksEPSS 1.9%