CVE-2025-2240

Executive Summary

CVE-2025-2240 is a denial-of-service (DoS) vulnerability in the SmallRye Fault Tolerance library. The flaw allows an unauthenticated attacker to trigger an out-of-memory (OOM) condition by repeatedly calling the metrics URI. Each request creates a new object in the internal meterMap, leading to uncontrolled memory consumption and eventual service crash. No patch is currently available, and no public exploit code has been released. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed here with a high severity due to the ease of exploitation and potential impact on availability.

Supply Chain & Package Security

SmallRye Fault Tolerance is a Java library commonly used in MicroProfile and Quarkus applications. It is distributed via Maven Central. The vulnerability affects any application that exposes the metrics endpoint and uses the affected library version. Since no patch exists, organizations must rely on workarounds such as disabling the metrics endpoint or implementing rate limiting.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service due to OOM.

Threat Level: High – Exploitation is trivial and can cause immediate service disruption.

Deep Dive & Mechanics

The vulnerability resides in the metrics collection mechanism of SmallRye Fault Tolerance. When the metrics endpoint (e.g., /metrics) is called, the library creates a new Meter object for each metric and stores it in a ConcurrentHashMap called meterMap. The issue is that the map is never cleaned up or bounded, so repeated calls cause unbounded memory allocation. An attacker can send a high volume of requests to the metrics URI, each triggering the creation of new objects, eventually exhausting the JVM heap and causing an OutOfMemoryError.

The root cause is a missing size limit or eviction policy on the meterMap. The map is designed to cache metrics, but without a cap, it becomes a vector for resource exhaustion.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

public class MetricRegistry {
    private final ConcurrentMap<String, Meter> meterMap = new ConcurrentHashMap<>();

    public Meter getMeter(String name) {
        return meterMap.computeIfAbsent(name, k -> new Meter());
    }
}

Every unique metric name creates a new Meter object. An attacker can generate unique names (e.g., by appending random strings) to fill the map.

Patched Code (hypothetical):

public class MetricRegistry {
    private final ConcurrentMap<String, Meter> meterMap = new ConcurrentHashMap<>();
    private final int maxMeters = 10000;

    public Meter getMeter(String name) {
        if (meterMap.size() >= maxMeters) {
            throw new IllegalStateException("Too many meters");
        }
        return meterMap.computeIfAbsent(name, k -> new Meter());
    }
}

A proper patch would enforce a maximum size on the map and reject new entries when the limit is reached.

Exploitation & Lab Setup

Red Team

1. Identify Target: Scan for endpoints exposing /metrics or similar paths.
2. Craft Payload: Use a simple HTTP client to send repeated requests with unique metric names.

   for i in $(seq 1 100000); do
     curl -s "http://target:8080/metrics?name=attack_$i" &
   done
   

3. Monitor: Observe the target’s memory usage and eventual crash.

Blue Team

1. Detection: Monitor for a high rate of requests to the metrics endpoint with unique query parameters.
2. Mitigation: Disable the metrics endpoint if not needed, or implement rate limiting and IP-based blocking.
3. Forensics: Check JVM heap dumps for excessive Meter objects in meterMap.

Indicators of Compromise (IOCs)

• Network: High volume of HTTP requests to /metrics with varying query parameters.
• System: JVM OutOfMemoryError logs, high heap usage, and application crashes.
• File: Heap dump files showing thousands of Meter instances.

Detection Engineering

YARA Rule

rule CVE_2025_2240_MeterMap_OOM {
    meta:
        description = "Detects excessive Meter objects in heap dumps"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $meter_class = "io.smallrye.faulttolerance.metrics.Meter"
        $map_string = "meterMap"
    condition:
        #meter_class > 1000 and $map_string
}

Sigma Rule

title: CVE-2025-2240 Metrics Endpoint Abuse
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects high rate of requests to metrics endpoint with unique parameters
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/metrics'
    condition: selection | count() by src_ip > 100 in 60 seconds
falsepositives:
    - Legitimate monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2240 Metrics Endpoint Flood"; flow:to_server; http.method; content:"GET"; http.uri; content:"/metrics"; http.uri; pcre:"/name=[a-z0-9]+/i"; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable the metrics endpoint by setting smallrye.faulttolerance.metrics.enabled=false in application properties.
• Short-term: Implement a reverse proxy (e.g., Nginx) with rate limiting on the /metrics path.
• Long-term: Apply the official patch once released by the SmallRye project. Monitor the SmallRye GitHub repository for updates.
• Workaround: If the metrics endpoint is required, restrict access to trusted IPs only.

Valters IT