CVE-2026-94449

Published: Sep 21, 2026Modified: Oct 16, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (4)

https://access.redhat.com/errata/RHSA-2026:83082

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:83520

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-94449

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2537502

Source: secalert@redhat.com

Timeline

No history available yet.