CVE-2025-1634
Fixed in a distro release EPSS <1%CVSS 7.5
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
Products: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, Red Hat build of Quarkus 3.15.3.SP1, Red Hat build of Quarkus 3.8.6.SP3, Red Hat Streams for Apache Kafka 2.9.1, Red Hat Streams for Apache Kafka 3.0.0, Red Hat Streams for Apache Kafka 3.1.0, Red Hat build of Quarkus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.quarkus:quarkus-resteasy | 3.19.1 |
| Maven | io.quarkus:quarkus-resteasy | 3.15.3.1 |
| Maven | io.quarkus:quarkus-resteasy | 3.8.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apicurio-registry | 3.0.6-r2 |
| Chainguard | apicurio-registry-nginx-config | 3.0.6-r2 |
| Chainguard | apicurio-registry-ui | 3.0.6-r2 |
| Wolfi | apicurio-registry | 3.0.6-r2 |
| Wolfi | apicurio-registry-nginx-config | 3.0.6-r2 |
| Wolfi | apicurio-registry-ui | 3.0.6-r2 |