CVE-2025-1634

highpriority · track · 0EPSS 0.010 · 62 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.99% (62nd) EPSS

CVSS 7.5 · high

Is it mine?

39 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · osv

EPSS · scored 2026-10-27

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · secalert@redhat.com USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-401USCWE-401US

affected products (39)

Products and version ranges known to be affected.

Atlassian Bamboo <10.2.2all versionscert_bundDE
Atlassian Bamboo <9.6.11all versionscert_bundDE
Dell Secure Connect Gateway <5.34.00.16all versionscert_bundDE
Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM FlashSystemall versionscert_bundDEcpe:/a:ibm:flashsystem:-
IBM InfoSphere Information Server 11.7all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
IBM License Metric Toolall versionscert_bundDEcpe:/a:ibm:license_metric_tool:-
IBM Maximo Asset Management 7.6.1all versionscert_bundDEcpe:/a:ibm:maximo_asset_management:7.6.1
IBM Operational Decision Manager <V8.11.0.1 Interim fix 042all versionscert_bundDE
IBM Operational Decision Manager <V8.11.1.0: Interim fix 039all versionscert_bundDE
IBM Operational Decision Manager <V8.12.0.1: Interim fix 024all versionscert_bundDE
IBM Operational Decision Manager <V9.0.0.1: Interim fix 007all versionscert_bundDE
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM SAN Volume Controllerall versionscert_bundDEcpe:/a:ibm:san_volume_controller:-
IBM SPSS Analytic Serverall versionscert_bundDEcpe:/a:ibm:spss:analytic_server
IBM Security Guardium 12all versionscert_bundDEcpe:/a:ibm:security_guardium:sqlguard_12.0p35_bundle_jan-28-2025
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Apache Camel 1all versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_1
Red Hat Enterprise Linux Quarkus <3.15.3.SP1all versionscert_bundDE
Red Hat Enterprise Linux Quarkus <3.20.1all versionscert_bundDE

showing 20 of 39

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0460Red Hat Enterprise Linux (Quarkus): Mehrere SchwachstellenDeutsch2025-02-27csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Quarkus auf Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, oder einen Denial of Service auszulösen.
GHSA-4fwr-mh5q-hchhio.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout2025-02-26ghsa · osvUS
A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund osv NVD CVE.org MITRE

published 2025-02-26modified 2026-10-20

references (23)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan