CVE-2025-1634
Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
- Record
CVE-2025-1634- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
EUVDEUVD-2025-5294
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
- Record
EUVD-2025-5294- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4fwr-mh5q-hchh
io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
- Record
GHSA-4fwr-mh5q-hchh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
NVD
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
- Record
CVE-2025-1634- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
- Record
CVE-2025-1634- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVGHSA-4fwr-mh5q-hchh
io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
- Record
GHSA-4fwr-mh5q-hchh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-resteasyMaven | 3.16.0.CR1 up to 3.19.1 | 3.19.1 |
io.quarkus:quarkus-resteasyMaven | 3.9.0.CR1 up to 3.15.3.1 | 3.15.3.1 |
io.quarkus:quarkus-resteasyMaven | before 3.8.6.1 | 3.8.6.1 |
io.quarkus:quarkus-resteasyMaven | 3.16.0.CR1 up to 3.19.1, plus listed versions 3.16.03.16.13.16.23.16.33.16.4 Show 18 moreShow less3.17.03.17.0.CR13.17.13.17.23.17.33.17.43.17.53.17.63.17.73.17.83.18.03.18.0.CR13.18.13.18.23.18.33.18.43.19.03.19.0.CR1 | 3.19.1 |
io.quarkus:quarkus-resteasyMaven | 3.9.0.CR1 up to 3.15.3.1, plus listed versions 3.10.03.10.0.CR13.10.13.10.23.11.0 Show 32 moreShow less3.11.0.CR13.11.13.11.23.11.33.12.03.12.0.CR13.12.13.12.23.12.33.13.03.13.0.CR13.13.13.13.23.13.33.14.03.14.0.CR13.14.13.14.23.14.33.14.43.15.03.15.0.CR13.15.13.15.23.15.33.9.03.9.0.CR23.9.13.9.23.9.33.9.43.9.5 | 3.15.3.1 |
io.quarkus:quarkus-resteasyMaven | before 3.8.6.1, plus listed versions 0.11.00.12.00.13.00.13.10.13.2 Show 45 moreShow less0.13.30.14.00.15.00.16.00.16.10.17.00.18.00.19.00.19.10.20.00.21.00.21.10.21.20.22.00.23.00.23.10.23.20.24.00.25.00.26.00.26.10.27.00.28.00.28.11.0.0.CR11.0.0.CR21.0.0.Final1.0.1.Final1.1.0.CR11.1.0.Final1.1.1.Final1.10.0.CR11.10.0.Final1.10.1.Final1.10.2.Final1.10.3.Final1.10.4.Final1.10.5.Final1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final1.11.2.Final1.11.3.Final | 3.8.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-1634 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Apache Camel 4.8 For Quarkus 3.15, published February 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 63rd percentile. Fixed in io.quarkus:quarkus-resteasy 3.19.1.
References
access.redhat.com/errata/RHSA-2025:12511
Show 15 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2347319
github.com/quarkusio/quarkus/issues/46412
nvd.nist.gov/vuln/detail/CVE-2025-1634
Left out here: 241 versions. The JSON record has them.