CVE-2025-1634
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-02-26 17:15:22.083000
Last modified
2026-10-20 05:16:53.353000
View original CVE JSON
{
"id": "CVE-2025-1634",
"sourceIdentifier": "[email protected]",
"published": "2025-02-26T17:15:22.083",
"lastModified": "2026-10-20T05:16:53.353",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError."
},
{
"lang": "es",
"value": "Se ha encontrado un error en la extensión quarkus-resteasy, que ocasiona pérdidas de memoria cuando los clientes efectúan peticiones con timeouts bajos. Si la petición de un cliente caduca, no se libera correctamente un buffer, lo que ocasiona un mayor uso de memoria y una eventual finalización de la aplicación debido a un OutOfMemoryError."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/quarkusio/quarkus",
"packageName": "quarkus-resteasy",
"versions": [
{
"version": "0",
"lessThan": "3.8.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.15.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-resteasy",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3.15"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.15.3.SP1",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.15"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.8.6.SP3",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.8"
]
},
{
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 2.9.1",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
]
},
{
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 3.0.0",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3.0::el9"
]
},
{
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 3.1.0",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-resteasy",
"cpes": [
"cpe:/a:redhat:amq_streams:3.1::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-resteasy",
"cpes": [
"cpe:/a:redhat:quarkus:3"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-02-26T17:22:33.342704Z",
"id": "CVE-2025-1634",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:12511",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:1884",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:1885",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:2067",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23417",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9922",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-1634",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319",
"source": "[email protected]"
},
{
"url": "https://github.com/quarkusio/quarkus/issues/46412",
"source": "[email protected]"
},
{
"url": "https://github.com/quarkusio/quarkus/pull/46419",
"source": "[email protected]"
}
]
}