The vulnerability CVE-2026-94449 exists in the SmallRye Fault Tolerance library, which Quarkus uses to implement retries and circuit breakers. When ApplyGuard or ApplyFaultTolerance annotations are used, the library fails to release internal metrics-related tracking objects after each request. This leads to a steady increase in heap memory consumption, culminating in application instability and crashes due to memory exhaustion. The flaw can be triggered remotely without authentication, causing a denial of service by exhausting application memory. Red Hat's advisory confirms the issue and classifies it as an Important severity vulnerability with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Successful exploitation allows a remote attacker to cause uncontrolled resource consumption by triggering a memory leak in the SmallRye Fault Tolerance library. This results in denial of service through application slowdown and eventual crash due to heap memory exhaustion. There is no impact on confidentiality or integrity, but availability is severely affected.

Red Hat has published an advisory for this vulnerability but does not explicitly state that a fix is currently available. The advisory notes the issue is under investigation or affected status for some products, with potential fixes to be released in the near future. Users should monitor the Red Hat advisory page for updates and apply patches once available. No vendor-provided mitigations or workarounds are currently documented. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.