CVE-2025-2240: Smallrye-fault-tolerance: smallrye fault tolerance
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
Other sources
A flaw was found in Smallrye. smallrye-fault-tolerance is vulnerable to an Out-of-Memory (OOM) which is triggered externally when calling the metrics URI. Every call creates a new object within meterMap and may lead to Denial of Service (DoS).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.smallrye:smallrye-fault-tolerance-coreto a version that resolves this vulnerability.Fixed in 6.9.0 - Upgrade
Upgrade
maven/io.smallrye:smallrye-fault-tolerance-coreto a version that resolves this vulnerability.Fixed in 6.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2240?
CVE-2025-2240 is classified as a denial of service (DoS) vulnerability due to its potential to trigger an out-of-memory condition.
How do I fix CVE-2025-2240?
To mitigate CVE-2025-2240, update Smallrye to the latest version that addresses the out-of-memory vulnerability.
What causes CVE-2025-2240?
CVE-2025-2240 is caused by an uncontrolled growth of objects within the meterMap when accessing the metrics URI.
Who is affected by CVE-2025-2240?
CVE-2025-2240 affects systems running the Smallrye Fault Tolerance component.
Can CVE-2025-2240 be exploited remotely?
Yes, CVE-2025-2240 can be exploited remotely through calls to the metrics URI, triggering the out-of-memory issue.