A memory exhaustion vulnerability in the SmallRye Fault Tolerance library poses a significant risk to the availability of Quarkus-based microservices.

This is an uncontrolled resource consumption vulnerability (CWE-400) triggered when using ApplyGuard or ApplyFaultTolerance annotations. An unauthenticated attacker can remotely cause a denial of service by sending requests that trigger the memory leak, leading to system instability and eventual crashes.

The vulnerability presents a high risk to service availability, as successful exploitation results in an application crash due to memory exhaustion. With a CVSS score of 7.5, this flaw is particularly critical for production environments where continuous uptime for microservices is required for business operations.

Immediate Action: Consult the official Red Hat security advisory to identify the specific patched versions for your product build and apply the updates as soon as they become available.

Proactive Monitoring: Monitor server memory utilization and garbage collection metrics for anomalous, steady increases that do not correlate with legitimate traffic spikes.

Compensating Controls: Implement resource quotas and rate limiting at the API gateway or load balancer level to restrict the volume of requests reaching vulnerable endpoints, thereby slowing the rate of memory depletion.

Public Exploit Available: Unknown

Given the potential for remote denial of service, security teams should prioritize tracking the availability of patches for their specific Red Hat builds. While no active exploitation is currently confirmed, the ease of triggering this flaw necessitates swift action once the vendor releases a fix to ensure the stability of critical infrastructure.