CVE-2025-1634 Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
A memory leak in the Quarkus RESTEasy extension causes application crashes when client requests time out, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1634?
CVE-2025-1634 is a high-severity denial of service vulnerability in Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, published on 26 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
Weakness: CWE-401
Which versions are affected by CVE-2025-1634?
6 open source packages ship an affected version, including io.quarkus:quarkus-resteasy.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkus:quarkus-resteasy Maven | All versions | 3.8.6.1 |
io.quarkus:quarkus-resteasy Maven | All versions | 3.8.6.1 |
io.quarkus:quarkus-resteasy Maven | From 3.16.0.CR1 | 3.19.1 |
io.quarkus:quarkus-resteasy Maven | From 3.16.0.CR1 | 3.19.1 |
io.quarkus:quarkus-resteasy Maven | From 3.9.0.CR1 | 3.15.3.1 |
io.quarkus:quarkus-resteasy Maven | From 3.9.0.CR1 | 3.15.3.1 |
How do I fix CVE-2025-1634?
Upgrade io.quarkus:quarkus-resteasy to a fixed version for your release line: 3.8.6.1, 3.19.1 or 3.15.3.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-1634 being exploited?
There is no known exploitation of CVE-2025-1634 in the wild and no public exploit code.
Sources
Also known as GHSA-4fwr-mh5q-hchh.