What is CVE-2026-94449?

CVE-2026-94449 is a high-severity vulnerability in Red Hat Exploit Intelligence, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-09-21.

How severe is CVE-2026-94449?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Red Hat Exploit Intelligence

CVE-2026-94449

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

Vulnerability class: DoS (Denial of Service)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
secalert@redhat.com (x_refsource_REDHAT, issue-tracking)

Frequently asked questions

What is CVE-2026-94449?: CVE-2026-94449 is a high-severity vulnerability in Red Hat Exploit Intelligence, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-09-21.
How severe is CVE-2026-94449?: High severity. CVSS v3 base score is 7.5 out of 10.