Bug 2537502 (CVE-2026-94449)

Summary:	CVE-2026-94449 quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ant, cescoffi, cmah, ewittman, fmongiar, gmalinko, gsmet, gtanzill, janstey, jbuscemi, jmartisk, jnethert, kaycoth, manderse, nipatil, olubyans, ozzy, pantinor, pdelbell, pjindal, rguimara, rkubis, rstepani, sbiarozk, security-response-team, varjain
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-21 16:45:30 UTC

A memory leak vulnerability was discovered in SmallRye Fault Tolerance core. When a programmatic Guard, TypedGuard, or FaultTolerance is invoked through the ApplyGuard or the deprecated ApplyFaultTolerance annotations, the library retains one DelegatingMeteredOperation and one MetricsCollector instance per invocation for the lifetime of the singleton guard.

The root cause is that these objects are never released, causing the heap to grow linearly with the number of calls. An unauthenticated remote attacker can exploit this by sending a high volume of requests to a vulnerable endpoint, leading to increased garbage collection pressure, significant performance degradation, and an eventual OutOfMemoryError OOM condition. This impact occurs regardless of whether a description is set for the guard.

Comment 2 Jon Orris 2026-10-15 23:25:29 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:83670 https://access.redhat.com/errata/RHSA-2026:83670