{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/smallrye/smallrye-fault-tolerance","packageName":"smallrye-fault-tolerance-core","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"6.4.2","status":"affected","version":"6.3.0","versionType":"semver"},{"lessThan":"6.9.0","status":"affected","version":"6.5.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Apache Camel 4.8.5 for Spring Boot","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-camel-bom","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-cxf-bom","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Quarkus 3.15.4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Apicurio Registry 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"smallrye-fault-tolerance-core","product":"Red Hat build of Apicurio Registry 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"smallrye-fault-tolerance-apiimpl","product":"Red Hat build of Quarkus","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"smallrye-fault-tolerance-core","product":"Red Hat Fuse 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"smallrye-fault-tolerance-core","product":"Red Hat Integration Camel K 1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"smallrye-fault-tolerance-core","product":"Red Hat JBoss Enterprise Application Platform 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"smallrye-fault-tolerance-core","product":"Red Hat JBoss Enterprise Application Platform 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"smallrye-fault-tolerance-core","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"io.smallrye:smallrye-fault-tolerance-core","product":"io.smallrye:smallrye-fault-tolerance-core","source":"OSV GHSA-gfh6-3pqw-x2j4","vendor":"","versions":[{"status":"affected","version":"6.3.0","versionType":"Maven"},{"status":"affected","version":"6.4.0","versionType":"Maven"},{"status":"affected","version":"6.4.1","versionType":"Maven"},{"events":[{"introduced":"6.3.0"},{"fixed":"6.4.2"}],"status":"unknown","version":"6.3.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"io.smallrye:smallrye-fault-tolerance-core","product":"io.smallrye:smallrye-fault-tolerance-core","source":"OSV GHSA-gfh6-3pqw-x2j4","vendor":"","versions":[{"status":"affected","version":"6.5.0","versionType":"Maven"},{"status":"affected","version":"6.6.0","versionType":"Maven"},{"status":"affected","version":"6.6.0-RC2","versionType":"Maven"},{"status":"affected","version":"6.6.1","versionType":"Maven"},{"status":"affected","version":"6.6.2","versionType":"Maven"},{"status":"affected","version":"6.6.3","versionType":"Maven"},{"status":"affected","version":"6.7.0","versionType":"Maven"},{"status":"affected","version":"6.7.1","versionType":"Maven"},{"status":"affected","version":"6.7.2","versionType":"Maven"},{"status":"affected","version":"6.7.3","versionType":"Maven"},{"status":"affected","version":"6.8.0","versionType":"Maven"},{"events":[{"introduced":"6.5.0"},{"fixed":"6.9.0"}],"status":"unknown","version":"6.5.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2025-2240","cwes":["CWE-1325"],"description":"A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.","epss":{"date":"2026-11-04","percentile":0.69098,"score":0.01234},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793830651987,"publishedAt":1741791315889,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3376"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3541"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3543"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-2240"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351452"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2025:3376"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2025:3541"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2025:3543"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2025-2240"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351452"},{"source":"secalert@redhat.com","tags":[],"url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-gfh6-3pqw-x2j4"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."},{"kind":"fix","source":"OSV GHSA-gfh6-3pqw-x2j4","text":"io.smallrye:smallrye-fault-tolerance-core (Maven): OSV reports a fixed version 6.4.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4"},{"kind":"fix","source":"OSV GHSA-gfh6-3pqw-x2j4","text":"io.smallrye:smallrye-fault-tolerance-core (Maven): OSV reports a fixed version 6.9.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4"}],"revision":"88ada5dbbdd35a5fed6e328653de56e10bf182319107b0734168ea898d48f2d4","sources":[{"modifiedAt":1793827844224,"name":"CNA: redhat","retrievedAt":1793830185369,"url":"https://www.cve.org/CVERecord?id=CVE-2025-2240"},{"modifiedAt":1793830651987,"name":"NVD","retrievedAt":1793837788896,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2240"},{"modifiedAt":1789012188502,"name":"OSV / GitHub Security Advisories","retrievedAt":1793830187089,"url":"https://osv.dev/vulnerability/GHSA-gfh6-3pqw-x2j4"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793830206465,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2240"}],"ssvc":{"assessedAt":1741792138646,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Smallrye-fault-tolerance: smallrye fault tolerance","updatedAt":1793837788896}