High [CVE-2025-1634] Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

This vulnerability is marked as and Important severity rather than Moderate because it allows an unauthenticated attacker to trigger a denial of service condition by repeatedly sending crafted HTTP requests with low timeouts.

The issue leads to a memory leak that cannot be recovered without restarting the application, ultimately resulting in an OutOfMemoryError and complete service failure. In a production environment, this vulnerability poses a significant risk to availability, especially for applications handling multiple concurrent requests.

Since no mitigation exists, all applications using quarkus-resteasy are affected until patched. The ease of exploitation, lack of required privileges, and high impact on service uptime justify the high severity rating.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-401.

Affected products named by the advisory: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15; Red Hat build of Quarkus 3.15.3.SP1; Red Hat build of Quarkus 3.8.6.SP3; Streams for Apache Kafka 2.9.1; and 2 more.