{"id":"CVE-2025-2240","title":"A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue","summary":"A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-1325"],"published":"2025-03-12","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-2240","references":[{"url":"https://access.redhat.com/errata/RHSA-2025:3376","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:3541","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:3543","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2025-2240","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351452","label":"secalert@redhat.com"},{"url":"https://github.com/advisories/GHSA-gfh6-3pqw-x2j4","label":"secalert@redhat.com"}],"tags":["nvd"],"epss":0.01001,"epssPercentile":0.60843,"ingestedAt":"2026-08-04T09:39:29.957Z","slug":"CVE-2025-2240","body":"## Overview\n\nA flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}