CVE-2026-94449: SmallRye Fault Tolerance DOS Vulnerability

CVE-2026-94449 Overview

CVE-2026-94449 is a memory leak vulnerability in the SmallRye Fault Tolerance library. Quarkus applications use this library to implement retries, circuit breakers, and other resilience patterns for microservices. The flaw occurs when applications use the @ApplyGuard or @ApplyFaultTolerance annotations. The library fails to release internal tracking objects after each request completes. Memory usage grows steadily with every processed request. Affected services eventually slow down and crash from resource exhaustion. The issue is classified under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Remote unauthenticated attackers can trigger denial of service by sending repeated requests to endpoints protected by the affected fault tolerance annotations.

Affected Products

SmallRye Fault Tolerance library
Quarkus applications using @ApplyGuard annotation
Quarkus applications using @ApplyFaultTolerance annotation

Discovery Timeline

2026-09-21 - CVE-2026-94449 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94449

Vulnerability Analysis

The SmallRye Fault Tolerance library provides declarative resilience patterns for Java microservices. Developers annotate methods with @ApplyGuard or @ApplyFaultTolerance to enable retries, timeouts, bulkheads, and circuit breakers. The library allocates internal tracking objects for each guarded invocation to maintain state across the fault tolerance pipeline.

The vulnerability stems from missing cleanup logic in the request lifecycle. Tracking objects allocated during method interception are not released after the request completes. Each invocation adds new objects to memory that the garbage collector cannot reclaim. Under sustained load, heap consumption grows until the Java Virtual Machine exhausts available memory.

The impact is limited to availability. The flaw does not expose data or allow code execution. However, network-reachable endpoints protected by the affected annotations become viable denial-of-service targets. Attackers do not need authentication or user interaction to trigger the leak.

Root Cause

The root cause is improper resource management inside the fault tolerance interceptor. Internal tracking objects tied to guarded method calls persist beyond their intended scope. The library retains strong references that block garbage collection, producing an unbounded memory growth pattern.

Attack Vector

An attacker sends repeated HTTP requests to any Quarkus endpoint whose handler chain includes @ApplyGuard or @ApplyFaultTolerance. Each request contributes to the leak. Given enough traffic, the target application crashes with an OutOfMemoryError and requires a restart. See the Red Hat CVE-2026-94449 Advisory and Red Hat Bug Report #2537502 for technical context.

Detection Methods for CVE-2026-94449

Indicators of Compromise

Sustained heap growth on Quarkus services that does not recede after garbage collection cycles.
OutOfMemoryError entries in application logs following extended periods of normal traffic.
Increasing counts of live SmallRye Fault Tolerance internal tracking objects in heap dumps.
Progressive latency increases on endpoints protected by @ApplyGuard or @ApplyFaultTolerance.

Detection Strategies

Perform static analysis of Quarkus codebases to inventory usage of @ApplyGuard and @ApplyFaultTolerance annotations.
Enable JVM heap monitoring with tools such as Java Flight Recorder or JMX to capture object retention trends.
Compare heap snapshots taken before and after load tests to identify unreleased SmallRye tracking objects.
Correlate request-rate spikes with memory growth to distinguish exploitation from normal usage patterns.

Monitoring Recommendations

Alert on Java heap utilization exceeding baseline thresholds for extended windows.
Track garbage collection frequency and pause duration for anomalous increases.
Monitor container restart counts and OOMKilled events in Kubernetes deployments running Quarkus workloads.
Ingest application and JVM metrics into a centralized platform for cross-service correlation.

How to Mitigate CVE-2026-94449

Immediate Actions Required

Inventory all Quarkus services that depend on SmallRye Fault Tolerance and identify uses of the affected annotations.
Apply vendor updates for SmallRye Fault Tolerance and Quarkus as they become available through the Red Hat CVE-2026-94449 Advisory.
Configure JVM memory limits and automated restart policies to reduce impact until patches are deployed.
Rate-limit exposed endpoints protected by @ApplyGuard or @ApplyFaultTolerance to slow leak accumulation.

Patch Information

Refer to the Red Hat CVE-2026-94449 Advisory and Red Hat Bug Report #2537502 for the latest patched versions of SmallRye Fault Tolerance and downstream Quarkus distributions. Upgrade all affected microservices to fixed releases in coordinated rollouts.

Workarounds

Replace @ApplyGuard and @ApplyFaultTolerance with equivalent programmatic fault tolerance handling where feasible.
Deploy upstream reverse proxies or API gateways to enforce request rate limits on affected endpoints.
Schedule periodic restarts of vulnerable services to reclaim leaked memory until patches are available.
Reduce traffic exposure by placing affected services behind authenticated network segments.

bash

# Example rate limit enforcement using Kubernetes with an ingress annotation
kubectl annotate ingress quarkus-service \
  nginx.ingress.kubernetes.io/limit-rps="20" \
  nginx.ingress.kubernetes.io/limit-connections="10"