HIGH7.5
GHSA-gfh6-3pqw-x2j4
SmallRye Fault Tolerance out-of-memory (OOM) issue
Quick fix
GHSA-gfh6-3pqw-x2j4 — io.smallrye:smallrye-fault-tolerance-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>6.4.2</version> for io.smallrye:smallrye-fault-tolerance-coreDetails
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/io.smallrye:smallrye-fault-tolerance-core
Introduced in:
6.3.0Fixed in: 6.4.2Fix
# pom.xml: bump <version>6.4.2</version> for io.smallrye:smallrye-fault-tolerance-coreMaven/io.smallrye:smallrye-fault-tolerance-core
Introduced in:
6.5.0Fixed in: 6.9.0Fix
# pom.xml: bump <version>6.9.0</version> for io.smallrye:smallrye-fault-tolerance-coreReferences
- https://nvd.nist.gov/vuln/detail/CVE-2025-2240[ADVISORY]
- https://github.com/smallrye/smallrye-fault-tolerance/pull/985[WEB]
- https://github.com/smallrye/smallrye-fault-tolerance/pull/985/files#diff-88c4a089e0cb88e4bdf285490e2617c29b9979a778e33957e4448260e286b91aR299[WEB]
- https://github.com/smallrye/smallrye-fault-tolerance/commit/e8bcad3d5e8bbac0a3219bd5c13661adf6ed6bbb[WEB]
- https://access.redhat.com/errata/RHSA-2025:3376[WEB]
- https://access.redhat.com/errata/RHSA-2025:3541[WEB]
- https://access.redhat.com/errata/RHSA-2025:3543[WEB]
- https://access.redhat.com/security/cve/CVE-2025-2240[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2351452[WEB]
- https://github.com/smallrye/smallrye-fault-tolerance[PACKAGE]
- https://smallrye.io/blog/fault-tolerance-6-9-0[WEB]