The Red Hat build of Quarkus 3.15.4 release includes a security fix for CVE-2025-2240 affecting the io.smallrye/smallrye-fault-tolerance-core component. This vulnerability is categorized under CWE-1325. Red Hat Product Security rates the impact as important (high severity). The advisory does not provide a CVSS score but confirms the availability of an official update that addresses this issue. The update is part of the Quarkus 3.15.4 release and requires users to apply all prior relevant errata before updating. Additional fixes and improvements are included in this release, but the security fix specifically targets the SmallRye Fault Tolerance vulnerability.

The vulnerability affects the SmallRye Fault Tolerance component within the Red Hat build of Quarkus, potentially impacting applications using this framework. Red Hat rates the security impact as important, indicating a high severity issue that could affect the reliability or security of affected systems. No known exploits in the wild have been reported. The update mitigates the vulnerability by patching the affected component in the 3.15.4 release.

An official fix is available in Red Hat build of Quarkus version 3.15.4. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated beyond applying the official update.