CVE-2026-94449

HighCVSS 7.5/10Last modified Oct 16, 2026

Description

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 21, 2026
Last modified: Oct 16, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-94456.3A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.p CVE-2026-944507.5Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause CVE-2026-944516.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoint CVE-2026-944537.5Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another pa CVE-2026-944557.1An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middle CVE-2026-944569.1Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used CVE-2026-944574.8Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94464.7A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the fil CVE-2026-944616.5Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.CVE-2026-944627.1Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associ CVE-2026-94477.3A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /us CVE-2026-94484.3A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php