High severity · published Sep 21, 2026
CVE-2026-94449
Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
Exploit Intelligence · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel 4 for Quarkus 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apicurio Registry 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.27.6.redhat · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Quarkus 3.33.4.redhat · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94449
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:83082
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:83520
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-94449
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2537502
More from Exploit Intelligence
6.5
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
9.8
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
9.8
CVE-2026-12773
BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication
9.1
CVE-2026-87744
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
9.1
CVE-2026-48746
vLLM: OpenAI auth bypass
