CVE-2026-94449: Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.
Other sources
A memory leak vulnerability was discovered in SmallRye Fault Tolerance core. When a programmatic Guard, TypedGuard, or FaultTolerance is invoked through the ApplyGuard or the deprecated ApplyFaultTolerance annotations, the library retains one DelegatingMeteredOperation and one MetricsCollector instance per invocation for the lifetime of the singleton guard.
The root cause is that these objects are never released, causing the heap to grow linearly with the number of calls. An unauthenticated remote attacker can exploit this by sending a high volume of requests to a vulnerable endpoint, leading to increased garbage collection pressure, significant performance degradation, and an eventual OutOfMemoryError OOM condition. This impact occurs regardless of whether a description is set for the guard.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications are exposed when they invoke a programmatic Guard, TypedGuard, or FaultTolerance through the ApplyGuard or deprecated ApplyFaultTolerance annotations. The retained objects persist for the lifetime of the singleton guard, so memory growth is proportional to the number of invocations.
What does an attacker need to exploit the issue?
An attacker needs network access to a vulnerable endpoint and can exploit the issue without authentication or user interaction. Sending a high volume of requests causes the affected invocation path to retain objects until memory pressure leads to degraded performance or an OutOfMemoryError.
Is this limited to the deprecated ApplyFaultTolerance annotation?
No. The issue affects use through both ApplyGuard and the deprecated ApplyFaultTolerance annotations.