PT-2025-11080 · Smallrye · Smallrye

Patrick Del Bello · Published 2025-03-12 · Updated 2025-03-12 · CVE-2025-2240

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Smallrye (affected versions not specified)

Description: A flaw in Smallrye, specifically in smallrye-fault-tolerance, can cause an out-of-memory (OOM) issue. This issue is triggered externally when calling the metrics URI, leading to the creation of a new object within meterMap on every call, which may result in a denial of service (DoS) issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1325

Related Identifiers

CVE-2025-2240

GHSA-GFH6-3PQW-X2J4

Affected Products

Smallrye

References · 16

• https://access.redhat.com/errata/RHSA-2025:3541 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:3543 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:3376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gfh6-3pqw-x2j4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2240 · Security Note
• https://github.com/smallrye/smallrye-fault-tolerance/pull/985 · Note
• https://github.com/smallrye/smallrye-fault-tolerance/pull/985/files#diff-88c4a089e0cb88e4bdf285490e2617c29b9979a778e33957e4448260e286b91aR299 · Note
• https://github.com/smallrye/smallrye-fault-tolerance · Note
• https://github.com/smallrye/smallrye-fault-tolerance/commit/e8bcad3d5e8bbac0a3219bd5c13661adf6ed6bbb · Note
• https://twitter.com/vulns_space/status/1899850055504343105 · Twitter Post
• https://smallrye.io/blog/fault-tolerance-6-9-0 · Note
• https://access.redhat.com/security/cve/CVE-2025-2240 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2351452 · Note
• https://t.me/latest_high_impact_cve/1954 · Telegram Post
• https://github.com/advisories/GHSA-gfh6-3pqw-x2j4 · Note