CVE-2026-94449
Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
- State
- Published
- Severity
- 7.5 High
- Published
- Sep 21, 2026
- Updated
- Oct 15, 2026
- Reserved
- Sep 21, 2026
Description
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Quarkus 3.27.6.redhatRed Hat |
|
Red Hat build of Quarkus 3.33.4.redhatRed Hat |
|
Exploit IntelligenceRed Hat | |
Red Hat build of Apache Camel 4 for Quarkus 3Red Hat | |
Red Hat build of Apicurio Registry 3Red Hat | |
Red Hat Fuse 7Red Hat |
References
- RHSA-2026:83082vendor-advisory
- RHSA-2026:83520vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-94449vdb-entry
- RHBZ#2537502issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.