Skip to content
Fencer Vulns
high 7.5

CVE-2026-94449 json

Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

published 2026-09-21 48 d ago modified 2026-11-06 3 d ago also EUVD-2026-84002

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

Patch / fix

  • Red Hat Red Hat Build of Apache Camel 3.33.4.redhat 3.33.4.redhat-00004
  • Red Hat Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004
  • Red Hat Red Hat build of Quarkus 3.33.4.redhat 3.33.4.redhat-00004

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-94449 updated cvss 7.5

quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: Memory leak in @ApplyGuard leads to Denial of Service

  • Red Hat build of Apache Camel 4 for Quarkus 3 quarkus-smallrye-fault-tolerance Red Hat build of Apicurio Registry 3 quarkus-smallrye-fault-tolerance
    affected: no fix available
  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9
    under investigation
  • Red Hat Build of Apache Camel 3.33.4.redhat quarkus-smallrye-fault-tolerance 3.33.4.redhat-00004
    fixed: vendor fix RHSA-2026:83670
  • Red Hat build of Quarkus 3.27.6.redhat quarkus-smallrye-fault-tolerance 3.27.6.redhat-00004
    fixed: vendor fix RHSA-2026:83082
  • Red Hat build of Quarkus 3.33.4.redhat quarkus-smallrye-fault-tolerance 3.33.4.redhat-00004
    fixed: vendor fix RHSA-2026:83520
  • Red Hat Build of Apache Camel 3.33.4.redhat jimfs 1.1, jna 5.8.0, bcel 6.7.0, gax 2.74.1, icu4j 78.2, joni 2.2.6, +1616 more Red Hat build of Quarkus 3.27.6.redhat jna 5.8.0, db2 1.21.4, h2 2.3.230, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, +1009 more Red Hat build of Quarkus 3.33.4.redhat jna 5.8.0, h2 2.4.240, y18n 5.0.8, cliui 8.0.1, guice 5.1.0, wasm 2.15.3, +1016 more
    not affected: vulnerable code not present
  • Red Hat Fuse 7 quarkus-smallrye-fault-tolerance
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
48 d ago

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat Red Hat build of Quarkus 3.33.4.redhat
  • Red Hat Exploit Intelligence
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat Fuse 7

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.