7.5

CVE-2025-2240

Smallrye-fault-tolerance: smallrye fault tolerance

A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://github.com/smallrye/smallrye-fault-tolerance
≫
Paket smallrye-fault-tolerance-core
Default Statusunaffected
Version 6.3.0
Version < 6.4.2
Status affected
Version 6.5.0
Version < 6.9.0
Status affected
HerstellerRed Hat
≫
Produkt Red Hat build of Apache Camel 4.8.5 for Spring Boot
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Build of Apache Camel 4.8 for Quarkus 3.15
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Build of Apache Camel 4.8 for Quarkus 3.15
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Quarkus 3.15.4
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Apicurio Registry 2
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Apicurio Registry 3
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Quarkus
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat build of Quarkus
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Fuse 7
Default Statusunknown
HerstellerRed Hat
≫
Produkt Red Hat Integration Camel K 1
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 8
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform Expansion Pack
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.569
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1325 Improperly Controlled Sequential Memory Allocation

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.