Vulnerability · Published Sep 21, 2026 · Assigned by redhat

CVE-2026-94449Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Exploit Intelligence from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.1%top 35.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat build of Quarkus 3.27.6.redhat	see references
Red Hat	Red Hat build of Quarkus 3.33.4.redhat	see references
Red Hat	Exploit Intelligence	see references
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	see references
Red Hat	Red Hat build of Apicurio Registry 3	see references
Red Hat	Red Hat Fuse 7	see references

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

RHSA-2026:83082 vendor-advisory, x_refsource_REDHAT
RHSA-2026:83520 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-94449 vdb-entry, x_refsource_REDHAT
RHBZ#2537502 issue-tracking, x_refsource_REDHAT