io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout

🗓️ 16 Dec 2025 23:13:43Reported by RedHatType

redhat🔗 access.redhat.com👁 24 Views

Flaw in Quarkus RestEasy extension leaks memory on timed-out client requests due to unreleased buffers.

Reporter	Title	Published	Views	Family All 35
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for October 2025 - Multiple CVEs addressed	3 Dec 202506:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to a denial of service	17 Feb 202608:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	30 Jun 202523:10	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for April 2025.	5 May 202516:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in quarkus-resteasy affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	21 Jul 202516:15	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in quarkus-resteasy affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	10 Sep 202520:25	–	ibm
ATTACKERKB	CVE-2025-1634	26 Feb 202517:15	–	attackerkb
Chainguard	CVE-2025-1634 vulnerabilities	19 Mar 202522:12	–	cgr
Circl	CVE-2025-1634	26 Feb 202517:24	–	circl
CNNVD	Red Hat Quarkus 安全漏洞	26 Feb 202500:00	–	cnnvd

Vulners

Node

AND

redhat amq_streamsRange<3.1el9

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-1634
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/quarkusio/quarkus/issues/46412
github	www.github.com/quarkusio/quarkus/pull/46419
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-1634
cve	www.cve.org/CVERecord

19 Aug 2026 07:39Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00791

SSVC

Quarkus RestEasy extension memory leak timeout requests unreleased buffers out of memory