io.smallrye vulnerabilities

Products

• io.smallrye/smallrye-fault-tolerance-core 1
• io.smallrye/smallrye-health-ui 1

Latest io.smallrye CVEs

Newest publication first

1. CVE-2025-2240 Smallrye-fault-tolerance: smallrye fault tolerance

   Published 2025-03-12

   High·CVSS 7.5 EPSS 1.2%

   A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.

2. CVE-2021-3914 SmallRye Health UI Cross-site Scripting vulnerability

   Published 2022-08-25

   Medium·CVSS 6.1 EPSS 0.54%

   It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.