7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-2240

CVE-2025-2240: SmallRye Fault Tolerance out-of-memory (OOM) issue

A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-2240

CVE-2025-2240:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.smallrye:smallrye-fault-tolerance-core	maven	>= 6.3.0, < 6.4.2	6.4.2
io.smallrye:smallrye-fault-tolerance-core	maven	>= 6.5.0, < 6.9.0	6.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from metrics-related code paths that generated UUID-based identifiers when no description was provided. The key functions were:

The buildMeteredOperation methods in Guard/TypedGuard/FaultTolerance builders, which created BasicMeteredOperationImpl instances with random UUIDs
DelegatingMetricsCollector's apply method that unconditionally cached these operations

These functions collectively caused meterMap to grow indefinitely when users created multiple unnamed Guard/TypedGuard instances. The commit fixed this by adding 'enabled' checks and skipping metrics emission when no description was set.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-2240: SmallRye Fault Tolerance out-of-memory (OOM) issue

CVE-2025-2240:

7.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Vulnerability Intelligence
Miggo AI

Detect and Respond To Threats Faster.

Technical Details

CVE-2025-2240: SmallRye Fault Tolerance out-of-memory (OOM) issue

Basic Information

Basic Information

7.5

7.5

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-2240: SmallRye Fault Tolerance out-of-memory (OOM) issue

CVE-2025-2240:

7.5

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Vulnerability IntelligenceMiggo AI

Technical Details

CVE-2025-2240: SmallRye Fault Tolerance out-of-memory (OOM) issue

Basic Information

Basic Information

7.5

7.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI