HIGH7.5
GHSA-4fwr-mh5q-hchh
io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout
Quick fix
GHSA-4fwr-mh5q-hchh — io.quarkus:quarkus-resteasy: upgrade to the fixed version with the command below.
# pom.xml: bump <version>3.19.1</version> for io.quarkus:quarkus-resteasyDetails
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/io.quarkus:quarkus-resteasy
Introduced in:
3.16.0.CR1Fixed in: 3.19.1Fix
# pom.xml: bump <version>3.19.1</version> for io.quarkus:quarkus-resteasyMaven/io.quarkus:quarkus-resteasy
Introduced in:
3.9.0.CR1Fixed in: 3.15.3.1Fix
# pom.xml: bump <version>3.15.3.1</version> for io.quarkus:quarkus-resteasyMaven/io.quarkus:quarkus-resteasy
Introduced in:
0Fixed in: 3.8.6.1Fix
# pom.xml: bump <version>3.8.6.1</version> for io.quarkus:quarkus-resteasyReferences
- https://nvd.nist.gov/vuln/detail/CVE-2025-1634[ADVISORY]
- https://github.com/quarkusio/quarkus/issues/46412[WEB]
- https://github.com/quarkusio/quarkus/pull/46426[WEB]
- https://github.com/quarkusio/quarkus/pull/46425[WEB]
- https://github.com/quarkusio/quarkus/pull/46419[WEB]
- https://github.com/quarkusio/quarkus/commit/80b8eb41678cdccb46e964dc324d048a5ef00f4b[WEB]
- https://github.com/quarkusio/quarkus/commit/70ffbd00d71d43afa7eade32d6ed586cf927c237[WEB]
- https://github.com/quarkusio/quarkus/commit/30d949a4c54ba1057738849a804d2329c09e57be[WEB]
- https://github.com/quarkusio/quarkus/commit/291296befabf659b71acbfc6e03a12bd09a920f8[WEB]
- https://github.com/quarkusio/quarkus[PACKAGE]
- https://bugzilla.redhat.com/show_bug.cgi?id=2347319[WEB]
- https://access.redhat.com/security/cve/CVE-2025-1634[WEB]
- https://access.redhat.com/errata/RHSA-2025:9922[WEB]
- https://access.redhat.com/errata/RHSA-2025:23417[WEB]
- https://access.redhat.com/errata/RHSA-2025:2067[WEB]
- https://access.redhat.com/errata/RHSA-2025:1885[WEB]
- https://access.redhat.com/errata/RHSA-2025:1884[WEB]
- https://access.redhat.com/errata/RHSA-2025:12511[WEB]