CVE-2025-2240
Fixed in a distro release EPSS 1%CVSS 7.5
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
Products: Red Hat build of Apache Camel 4.8.5 for Spring Boot, Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, Red Hat build of Quarkus 3.15.4, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Quarkus, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.smallrye:smallrye-fault-tolerance-core | 6.4.2 |
| Maven | io.smallrye:smallrye-fault-tolerance-core | 6.9.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apicurio-registry | 3.0.6-r2 |
| Chainguard | apicurio-registry-nginx-config | 3.0.6-r2 |
| Chainguard | apicurio-registry-ui | 3.0.6-r2 |
| Chainguard | wildfly | 35.0.1-r14 |
| Chainguard | wildfly-openjdk-17 | 35.0.1-r14 |
| Chainguard | wildfly-openjdk-17-compat | 35.0.1-r14 |
| Chainguard | wildfly-openjdk-21 | 35.0.1-r14 |
| Chainguard | wildfly-openjdk-21-compat | 35.0.1-r14 |
| Wolfi | apicurio-registry | 3.0.6-r2 |
| Wolfi | apicurio-registry-nginx-config | 3.0.6-r2 |
| Wolfi | apicurio-registry-ui | 3.0.6-r2 |
| Wolfi | wildfly | 35.0.1-r14 |
| Wolfi | wildfly-openjdk-17 | 35.0.1-r14 |
| Wolfi | wildfly-openjdk-17-compat | 35.0.1-r14 |
| Wolfi | wildfly-openjdk-21 | 35.0.1-r14 |
| Wolfi | wildfly-openjdk-21-compat | 35.0.1-r14 |