Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by redhat

CVE-2025-1634Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout

High 7.5

In plain English

A high-severity memory leak in quarkus-resteasy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 37.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.quarkus:quarkus-resteasy3.19.1GHSA-4fwr-mh5q-hchh
Mavenio.quarkus:quarkus-resteasy3.15.3.1GHSA-4fwr-mh5q-hchh
Mavenio.quarkus:quarkus-resteasy3.8.6.1GHSA-4fwr-mh5q-hchh

Affected products (as reported)

VendorProductVersions
quarkus-resteasy 0 – before 3.8.60 – before 3.15.3
Red Hat Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 see references
Red Hat Red Hat build of Quarkus 3.15.3.SP1 see references
Red Hat Red Hat build of Quarkus 3.8.6.SP3 see references
Red Hat Streams for Apache Kafka 2.9.1 see references
Red Hat Streams for Apache Kafka 3.0.0 see references
Red Hat Streams for Apache Kafka 3.1.0 see references
Red Hat Red Hat build of Quarkus see references

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References