CVE-2026-94449
Received Received - Intake

Memory Leak in SmallRye Fault Tolerance for Quarkus

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94449
EUVD
EUVD-2026-84002

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat quarkus_smallrye_fault_tolerance *
smallrye smallrye_fault_tolerance *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the SmallRye Fault Tolerance library used by Quarkus. When annotations like @ApplyGuard or @ApplyFaultTolerance are used, the library fails to release internal tracking objects after each request. These objects accumulate over time, causing the application's memory usage to grow steadily until it crashes due to lack of memory.

Detection Guidance

Monitor application memory usage over time using tools like jstat, VisualVM, or JConsole. Look for linear heap growth when @ApplyGuard or @ApplyFaultTolerance annotations are used. Check for increased garbage collection frequency and pauses.

Impact Analysis

An unauthenticated remote attacker can send a high volume of requests to a vulnerable endpoint. This causes increased garbage collection pressure, significant performance degradation, and eventually an OutOfMemoryError (OOM) condition. The application may slow down and crash, leading to service instability and downtime.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by exhausting application memory, which can lead to service instability or crashes. While it does not directly violate GDPR or HIPAA, such disruptions may impact compliance by failing to ensure availability of critical systems, particularly in environments where fault tolerance is required for maintaining service levels.

Mitigation Strategies

Upgrade to a patched version of SmallRye Fault Tolerance library. If upgrading is not immediately possible, disable programmatic guard invocations using @ApplyGuard or @ApplyFaultTolerance annotations as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart