CVE-2026-94449 Denial of service in Exploit Intelligence
A memory leak in the SmallRye Fault Tolerance library causes uncontrolled memory growth, leading to application crashes and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94449?
CVE-2026-94449 is a high-severity denial of service vulnerability in Red Hat Exploit Intelligence, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.
Weakness: CWE-400
Which versions are affected by CVE-2026-94449?
How do I fix CVE-2026-94449?
No fix has been published for CVE-2026-94449 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-94449 being exploited?
There is no known exploitation of CVE-2026-94449 in the wild and no public exploit code.
Sources
Also known as GHSA-hv8r-mpqx-qf8h.