The quarkus-resteasy extension contains a memory management flaw that leads to a memory leak when the client issues requests with extremely short timeouts. When a request times out, an internal buffer is not released properly, causing the JVM to accumulate unused objects until an OutOfMemoryError crashes the application. This flaw manifests as a denial‑of‑service condition, with a CVSS score of 7.5 and a weakness classified as CWE 401.

Affected systems include Red Hat's build of Apache Camel 4.8 for Quarkus 3.15, the Red Hat build of Quarkus 3.15.3.SP1, the Red Hat build of Quarkus 3.8.6.SP3, and Red Hat Streams for Apache Kafka (AMQ Streams) 2.9.1, 3.0.0, and 3.1.0. All shipped versions of the quarkus‑resteasy component in these products, as listed in the corresponding RHSA errata, are impacted.

The CVSS score indicates a high severity, but the EPSS score (< 1%) suggests a low likelihood of exploitation currently, and the flaw is not cataloged in CISA’s KEV list. Attackers who can repeatedly send client requests with short timeouts against the vulnerable application can trigger the memory leak, leading to uncontrolled memory growth and eventual crash. Because no temporary workaround is available, the risk remains until the vendor releases a patch.