CVE-2026-94449CWE-400denial-of-service

CVE-2026-94449

High · published September 21, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00630 · 49.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-09-21T21:19Z
References (4)
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 17:01Z
    Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
    cvelistv5