CVE-2025-2240 is an out-of-memory vulnerability in the smallrye-fault-tolerance-core component of SmallRye Fault Tolerance, part of Red Hat Build of Apache Camel 4.8 for Quarkus 3.15. The vulnerability is triggered externally via calls to the metrics URI, where each call creates a new object in meterMap, leading to uncontrolled sequential memory allocation. This can cause a denial of service due to resource exhaustion. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability. Red Hat has issued security advisories and released fixed versions (Quarkus 3.15.4 and Apache Camel 4.8 for Quarkus 3.15.4) that address this issue.

The vulnerability allows an unauthenticated attacker to cause a denial of service by triggering an out-of-memory condition through repeated calls to the metrics URI. This can disrupt availability of affected systems running vulnerable versions of Red Hat Build of Apache Camel 4.8 for Quarkus 3.15. No confidentiality or integrity impacts are reported.

Red Hat has released official security updates that fix this vulnerability in Red Hat Build of Quarkus 3.15.4 and Red Hat Build of Apache Camel 4.8 for Quarkus 3.15.4. Users should apply these updates as soon as possible. Before applying the update, back up existing installations, including applications, configuration files, and databases. Patch status is confirmed by Red Hat advisories: https://access.redhat.com/errata/RHSA-2025:3376 and https://access.redhat.com/errata/RHSA-2025:3541. No alternative mitigations are indicated in the vendor advisory.