CVE-2026-94449

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects...

CVE-2026-94449

A memory leak exists in the SmallRye Fault Tolerance library , which is utilized by Quarkus for microservice strategies like retries and circuit breakers. The vulnerability is triggered when using the ApplyGuard or ApplyFaultTolerance annotations, as the library fails to release internal tracking...

EUVD-2026-84002

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects...

CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +140 more potentially affected by CVE-2026-94449 via io.smallrye:smallrye-fault-tolerance-core (>=6.6.0-rc2, <=6.9.3)

io.smallrye:smallrye-fault-tolerance-core MAVEN version =6.6.0-rc2, =0.1.0, =0.1.0, =2026.07.09, =2026.07.09, =2026.07.08, =2026.07.08, =0.3.48, =0.14.8, =1.0.4, =3.0.10, =3.1.2, =3.0.10, =3.0.10, =3.0.10, =0.39.0, =0.50.0 and more Source cves: CVE-2026-94449 Source advisory: MEND:C...

CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects...

io.smallrye:smallrye-fault-tolerance (7.0.0-rc1), io.smallrye:smallrye-fault-tolerance-apiimpl (7.0.0-rc1) +7 more potentially affected by CVE-2026-94449 via io.smallrye:smallrye-fault-tolerance-core (7.0.0-rc1)

io.smallrye:smallrye-fault-tolerance-core MAVEN version 7.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.smallrye:smallrye-fault-tolerance-core and may be impacted: - io.smallrye:smallrye-fault-tolerance 7.0.0-rc1 -...

com.julien-dubois.bootui:bootui-quarkus (>=1.15.0, <=1.19.0), eu.maveniverse.maven.toolbox:mcp (>=0.15.2, <=0.15.8) +88 more potentially affected by CVE-2026-94449 via io.smallrye:smallrye-fault-tolerance-core (>=6.10.0, <=6.10.1)

io.smallrye:smallrye-fault-tolerance-core MAVEN version =6.10.0, =1.15.0, =0.15.2, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =0.51.0, =0.51.0, =1.0.0, =1.0.0, =1.0.0, =0.6.0, =0.6.0, =0.6.0, =0.16.0 and more Source cves: CVE-2026-94449 Source advisory: MEND:CVE-2026-94449...

CVE-2026-94449

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects...

PT-2026-96171

Name of the Vulnerable Software and Affected Versions SmallRye Fault Tolerance affected versions not specified Description A flaw in the SmallRye Fault Tolerance library, utilized by Quarkus for microservices strategies such as retries and circuit breakers, leads to a memory leak. The issue occur...

CVE-2026-94449: Uncontrolled Resource Consumption

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects...

Security Bulletin: IBM Event Streams is vulnerable to a denial of service (CVE-2025-2240)

Summary IBM Event Streams is vulnerable to a denial of service due to an out‑of‑memory condition in smallrye-fault-tolerance. Vulnerability Details CVEID:CVE-2025-2240 DESCRIPTION: A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory OOM issue. This...

smallrye-fault-tolerance: SmallRye Fault Tolerance

A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory OOM issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service DoS issue...

smallrye-fault-tolerance: SmallRye Fault Tolerance

A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory OOM issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service DoS issue...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.15.4 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

smallrye-fault-tolerance: SmallRye Fault Tolerance

A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory OOM issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service DoS issue...

Out-of-Memory (OOM)

io.smallrye, smallrye-fault-tolerance-core is vulnerable to an out-of-memory OOM. The vulnerability is due to uncontrolled object creation in meterMap when calling the metrics URI, allowing an attacker to trigger excessive memory consumption and cause a denial of service DoS condition...

com.qwlabs.doraemon:task-queue (>=0.3.50, <=0.3.54), io.automatiko.addons:automatiko-fault-tolerance-addon (0.41.0) +12 more potentially affected by CVE-2025-2240 via io.smallrye:smallrye-fault-tolerance-apiimpl (6.8.0)

io.smallrye:smallrye-fault-tolerance-apiimpl MAVEN version 6.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.smallrye:smallrye-fault-tolerance-apiimpl and may be impacted: - com.qwlabs.doraemon:task-queue =0.3.50, =3.19.0.cr1, =3.19.0.cr1,...

com.qwlabs.doraemon:task-queue (>=0.3.0, <=0.3.37), io.apicurio:apicurio-registry-app (>=3.0.4, <=3.0.6) +95 more potentially affected by CVE-2025-2240 via io.smallrye:smallrye-fault-tolerance-core (>=6.3.0, <=6.4.1)

io.smallrye:smallrye-fault-tolerance-core MAVEN version =6.3.0, =0.3.0, =3.0.4, =3.0.4, =3.0.4, =3.0.4, =0.34.0, =4.0.2, =4.0.2, =4.0.2, =3.10.0.cr1, =3.10.0.cr1, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.4.1 and more Source cves: CVE-2025-2240 Source advisory:...

com.qwlabs.doraemon:task-queue (>=0.3.38, <=0.3.54), hu.icellmobilsoft.reactive.messaging.redisstream:quarkus-reactive-messaging-redisstream-extension-sample (>=1.0.4, <=1.4.0) +35 more potentially affected by CVE-2025-2240 via io.smallrye:smallrye-fault-tolerance-core (>=6.5.0, <=6.8.0)

io.smallrye:smallrye-fault-tolerance-core MAVEN version =6.5.0, =0.3.38, =1.0.4, =0.38.0, =3.16.0.cr1, =3.20.0.cr1 and more Source cves: CVE-2025-2240 Source advisory: OSV:GHSA-GFH6-3PQW-X2J4https://vulners...