The SmallRye Fault Tolerance library, which gives Quarkus retry and circuit‑breaker capabilities, contains a flaw in its ApplyGuard/ApplyFaultTolerance handling. After each request the library keeps internal tracking objects instead of releasing them, causing a progressive increase in memory consumption. If the application processes many requests the memory pool is exhausted, the JVM eventually throws an OutOfMemoryError, the container stalls, and the application becomes unresponsive, effectively a denial‑of‑service. This vulnerability exploits a CWE‑400 input or resource‑handling weakness.

Red Hat Exploit Intelligence, Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, and Red Hat build of Quarkus. The affected versions are the currently released 3‑series builds of the Quarkus family and the corresponding 7‑series of Red Hat Fuse.

The CVSS v3.1 Base score of 7.5 classifies the flaw as high severity. The EPSS score is not publicly available, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector, inferred from the description, is any request that reaches a service annotated with @ApplyGuard or @ApplyFaultTolerance, which may be triggered by regular application use or by an attacker sending a large volume of requests to induce a memory exhaustion.