Description
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | smallrye-fault-tolerance-core | 6.3.0 – < 6.4.2, 6.5.0 – < 6.9.0 | 6.4.2 |
| Red Hat | Red Hat build of Apache Camel 4.8.5 for Spring Boot | — | — |
| Red Hat | Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 | — | — |
| Red Hat | Red Hat build of Quarkus 3.15.4 | — | — |
| Red Hat | Red Hat build of Apicurio Registry 2 | — | — |
| Red Hat | Red Hat build of Apicurio Registry 3 | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat Integration Camel K 1 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apicurio-registry +2 | 3.0.6-r2 | — |
| Wolfi rolling | wildfly +4 | 35.0.1-r14 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.smallrye:smallrye-fault-tolerance-core | >= 6.3.0, < 6.4.2 | 6.4.2 | GHSA-gfh6-3pqw-x2j4 |
| Maven | io.smallrye:smallrye-fault-tolerance-core | >= 6.5.0, < 6.9.0 | 6.9.0 | GHSA-gfh6-3pqw-x2j4 |
Advisories 1
- WID-SEC-2025-0693 Red Hat build of Quarkus: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 2, 2025
References
- RHSA-2025:3376 vendor-advisory
- RHSA-2025:3541 vendor-advisory
- RHSA-2025:3543 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-2240 vdb-entry
- RHBZ#2351452 issue-tracking
- https://github.com/advisories/GHSA-gfh6-3pqw-x2j4