REDHAT-BUG-2537502: High severity SmallRye Fault Tolerance core vulnerability
A memory leak vulnerability was discovered in SmallRye Fault Tolerance core. When a programmatic Guard, TypedGuard, or FaultTolerance is invoked through the ApplyGuard or the deprecated ApplyFaultTolerance annotations, the library retains one DelegatingMeteredOperation and one MetricsCollector instance per invocation for the lifetime of the singleton guard.
The root cause is that these objects are never released, causing the heap to grow linearly with the number of calls. An unauthenticated remote attacker can exploit this by sending a high volume of requests to a vulnerable endpoint, leading to increased garbage collection pressure, significant performance degradation, and an eventual OutOfMemoryError OOM condition. This impact occurs regardless of whether a description is set for the guard.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to remote exploitation?
Applications are exposed when a vulnerable endpoint invokes a programmatic Guard, TypedGuard, or FaultTolerance through the ApplyGuard or deprecated ApplyFaultTolerance annotations. An unauthenticated remote attacker can trigger the issue by sending a high volume of requests to that endpoint.
Does setting a guard description prevent the issue?
No. The memory leak occurs regardless of whether a description is set for the guard.
How can operators recognize active impact?
Affected processes retain one DelegatingMeteredOperation and one MetricsCollector instance for each invocation for the lifetime of the singleton guard. Heap usage grows linearly with calls, which can produce increased garbage-collection pressure, performance degradation, and eventually an OutOfMemoryError.