CVE-2025-1634: Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
Other sources
This vulnerability affects all currently maintained versions of the quarkus-resteasy extension. Applications exposing REST endpoints using this extension are susceptible to attacks where an adversary can intentionally cause client timeouts, leading to memory exhaustion and application failure. The issue has been addressed in a recent fix, and users are advised to update their dependencies accordingly.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1634?
CVE-2025-1634 has been classified as a high severity vulnerability due to potential application crashes from memory leaks.
How do I fix CVE-2025-1634?
To fix CVE-2025-1634, upgrade to versions 3.8.6.1, 3.15.3.1, or 3.19.1 of the io.quarkus:quarkus-resteasy package.
What are the symptoms of CVE-2025-1634?
Symptoms of CVE-2025-1634 include increased memory usage and potential OutOfMemoryError crashes when processing client requests.
Which versions of io.quarkus:quarkus-resteasy are affected by CVE-2025-1634?
Affected versions of io.quarkus:quarkus-resteasy are prior to 3.8.6.1, 3.15.3.1, and prior to 3.19.1.
What causes the memory leak in CVE-2025-1634?
The memory leak in CVE-2025-1634 is caused by buffers not being released correctly when client requests time out.