The vulnerability CVE-2025-1634 exists in the quarkus-resteasy extension where memory buffers are not released correctly after client request timeouts. This leads to memory leaks that can accumulate, resulting in an OutOfMemoryError and application crash. The issue is triggered by client requests with low timeout values. Red Hat has acknowledged this vulnerability and issued security advisories with patches for their builds of Quarkus, including version 3.8.6.SP3. The CVSS v3.1 base score is 7.5, indicating high severity, with an impact limited to availability (application crash) and no confidentiality or integrity impact reported.

The vulnerability causes a denial of service condition through memory exhaustion when client requests timeout, leading to application crashes due to OutOfMemoryError. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been reported. The affected software is Red Hat builds of Quarkus, specifically the quarkus-resteasy extension.

Red Hat has released official security updates that fix this memory leak vulnerability in their builds of Quarkus, including version 3.8.6.SP3. Users should apply these updates following Red Hat's guidance to remediate the issue. Before applying the update, ensure all previously released errata relevant to your system are applied. No additional mitigation steps are indicated by the vendor advisory.