GitHub Advisoryadvisory · Maven

GHSA-4fwr-mh5q-hchh io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout

HIGH Published 2025-02-26 Modified 2026-04-27 Official page ↗
Aliases
CVE-2025-1634
Ecosystem
Maven
Packages
io.quarkus:quarkus-resteasy
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401
Reviewed
2025-02-26

Affected packages

• Maven io.quarkus:quarkus-resteasy: >= 3.16.0.CR1, < 3.19.1 → fixed in 3.19.1 • Maven io.quarkus:quarkus-resteasy: >= 3.9.0.CR1, < 3.15.3.1 → fixed in 3.15.3.1 • Maven io.quarkus:quarkus-resteasy: < 3.8.6.1 → fixed in 3.8.6.1

Description

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

Related

Alias · CVE (1)

  • CVE-2025-1634 A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. vulnerability

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References