CVE-2026-94449

Executive Summary

CVE-2026-94449 is an uncontrolled resource consumption (memory exhaustion) flaw in the SmallRye Fault Tolerance library, which Quarkus uses to implement resilience strategies such as retries and circuit breakers for microservices. Applications that use the ApplyGuard or ApplyFaultTolerance annotations fail to release internal tracking objects after each request, causing memory to grow steadily until the application slows and eventually crashes with an out-of-memory condition. The vulnerability is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) and affects only availability; there is currently no public proof-of-concept, no Nuclei template, no vendor patch, and no CISA KEV listing.

Technical Analysis

The defect class is CWE-400, Uncontrolled Resource Consumption. Per the NVD description, the library "fails to release internal tracking objects after each request" when the ApplyGuard or ApplyFaultTolerance annotations are used. The annotations themselves are the trigger surface: any method or endpoint annotated with either annotation is, in principle, a candidate to accumulate the unreleased tracking state.

Two properties of this flaw are important for defenders:

1. It is a leak, not a single-shot crash. Each annotated invocation appears to retain state that is never returned to the allocator or pool. Memory consumption therefore tracks request volume rather than payload size, meaning the attacker does not need a large or malformed request — volume and repetition are sufficient.
2. The degradation is gradual and then sudden. The description states memory usage increases "steadily," leading first to application slowdown (typically GC pressure, longer pause times, reduced throughput) and then to a crash due to lack of memory. This gives defenders a detection window based on JVM heap trend lines rather than a single anomalous event.

The exact internal object that is retained is not identified in the available description, and no source, function name, or code path beyond the two annotation names is provided. Any claim about the specific collection, map, or reference that leaks would be speculation and is deliberately omitted here. What can be stated factually is that the retention is per-request, is specific to the ApplyGuard/ApplyFaultTolerance code path, and results in monotonic heap growth under sustained annotated traffic.

The attack surface is the set of networked, annotated invocation points in a Quarkus application — REST endpoints, gRPC methods, or message consumers that carry either annotation. Because the annotations are the documented mechanism for retries and circuit breakers, they are commonly placed on exactly the endpoints that are externally reachable, which broadens exposure.

Note also that retry semantics and this defect can compound: a failing dependency can cause the fault-tolerance machinery to be exercised repeatedly for a single client request, accelerating the accumulation rate. This is consistent with the described mechanism (per-request tracking that is never released) but should be treated as an inference about load amplification rather than a documented behavior.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE; the chain below is inferred from the vulnerability class (uncontrolled resource consumption) and the annotation-based trigger described by the vendor, and uses only names present in the source description.

1. Reconnaissance / target identification. The attacker identifies an internet- or network-reachable Quarkus-based service. This can be done by fingerprinting application responses and static assets for Quarkus/SmallRye indicators, or by targeting known API paths enumerated through normal application discovery. The attacker's goal is to find endpoints whose backing methods are annotated with ApplyGuard or ApplyFaultTolerance — i.e., endpoints that advertise retry or circuit-breaker behavior, often visible through redundant invocation patterns when a downstream dependency is slow.

2. Triggering the flaw class. The attacker sends sustained, repeated requests to those annotated endpoints. Because the defect is a failure to release internal tracking objects "after each request," the leak is driven by request count rather than by any malicious payload. No authentication is required (PR:N), no user interaction is required (UI:N), and the attack complexity is low (AC:L) — the attacker only needs the ability to send traffic. A slow or intermittent downstream dependency can be leveraged to force retry processing, but the core driver is simply volume against the annotated code path.

3. Execution method at the vulnerability-class level. There is no injection, no payload parsing, and no memory-corruption primitive. The "payload" is request volume. The attacker maintains concurrent or high-rate traffic against the annotated endpoints for as long as needed to drive heap consumption upward. Multiple endpoints annotated with either annotation can be hit in parallel to increase the accumulation rate.

4. Post-exploitation impact. Heap usage climbs steadily; response latency increases as GC works harder, then the JVM exhausts available memory and the application crashes. In containerized deployments this typically manifests as an OOMKill and restart; if the attacker continues sending traffic, the cycle repeats, producing a sustained availability outage. There is no confidentiality or integrity impact per the CVSS vector (C:N/I:N), and no scope change (S:U) — the effect is confined to the availability of the affected application instance.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Reading the subscores:

• AV:N / AC:L / PR:N / UI:N — the flaw is reachable over the network, requires no special conditions, no credentials, and no victim interaction. The barrier to attempted exploitation is therefore very low.
• C:N / I:N — no data exposure or modification is expected; this is purely an availability defect.
• A:H — successful sustained exploitation results in complete loss of availability of the affected service via memory exhaustion and crash.
• S:U — impact is contained within the vulnerable application's security authority.

Business impact centers on service availability for Quarkus microservices that use ApplyGuard or ApplyFaultTolerance. Because these annotations implement retry and circuit-breaker strategies, they are frequently applied to high-value, customer-facing or inter-service endpoints. A successful attack can:

• Cause API outages, failed transactions, and cascading failures in dependent services that call the affected application.
• Trigger repeated container restarts and OOMKills, generating operational noise and destabilizing orchestration platforms if replicas restart in waves.
• Consume node/cluster memory beyond the single pod, potentially evicting co-located workloads.

Blast radius is bounded by how widely the annotations are deployed: any service instance whose annotated endpoints are reachable is independently vulnerable. Because there is no authentication requirement, an external actor with ordinary network access represents the same threat level as an internal one. EPSS has not yet been scored by FIRST.org, so no probabilistic exploitation forecast is available; KEV status is NO, and there is no evidence of in-the-wild exploitation at the time of writing.

Detection Guidance

Sigma Rule

title: Potential SmallRye Fault Tolerance Memory Exhaustion via ApplyGuard/ApplyFaultTolerance
id: 8d3f1a62-9444-9cve-2026-94449
status: experimental
description: Detects sustained high-volume access to Quarkus endpoints exercising ApplyGuard or ApplyFaultTolerance, consistent with CVE-2026-94449 memory exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94449
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: quarkus
detection:
  selection_status:
    sc-status:
      - 200
      - 500
      - 503
  selection_rate:
    # Correlation: high request rate against the same client/path pair
    timeframe: 5m
  condition: selection_status | count() by c-ip, cs-uri-stem > 1000
fields:
  - c-ip
  - cs-uri-stem
  - sc-status
falsepositives:
  - Load generators and health checks with high legitimate rates
  - Internal service meshes with aggressive retry policies
level: medium
tags:
  - attack.t1499
  - cve.2026.94449

YARA Rule

rule CVE_2026_94449_SmallRye_FaultTolerance_Artifact
{
    meta:
        description = "Identifies Quarkus/SmallRye Fault Tolerance artifacts referencing ApplyGuard or ApplyFaultTolerance, relevant to CVE-2026-94449"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94449"
        date = "2026-01-01"
        cve = "CVE-2026-94449"

    strings:
        $a1 = "ApplyGuard" ascii wide
        $a2 = "ApplyFaultTolerance" ascii wide
        $b1 = "smallrye" ascii wide nocase
        $b2 = "fault-tolerance" ascii wide nocase
        $b3 = "io.smallrye.faulttolerance" ascii wide
        $c1 = "quarkus" ascii wide nocase

    condition:
        filesize < 50MB and
        (($a1 or $a2) and ($b1 or $b2 or $b3 or $c1))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94449 SmallRye Fault Tolerance Potential Memory Exhaustion Abuse"; flow:established,to_server; http.method; content:"GET"; threshold:type both, track by_src, count 500, seconds 60; classtype:attempted-dos; reference:cve,2026-94449; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94449; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202694449; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.response.status_code in (200, 500, 503) ]
  [ network where http.response.status_code in (200, 500, 503) ]
  [ network where http.response.status_code in (200, 500, 503) ]
| filter event.kind == "event"

Splunk SPL Query

index=web sourcetype=access_combined
| where status IN (200, 500, 503)
| stats count AS req_count by clientip, uri_path
| where req_count > 1000
| sort - req_count
| table clientip, uri_path, req_count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-94449,">
  <rule id="100944" level="10" frequency="1000" timeframe="300">
    <if_matched_sid>31108</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-94449: High-volume repeated requests to Quarkus endpoint (possible SmallRye Fault Tolerance memory exhaustion attempt).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is currently published.

1) Immediate mitigations

• Reduce or eliminate exposure of annotated endpoints: enforce authentication and network segmentation so only trusted callers can reach methods using ApplyGuard or ApplyFaultTolerance.
• Apply rate limiting and connection/request quotas at the ingress or service-mesh layer to cap request volume per client against annotated paths.
• Review where the two annotations are applied and deprioritize their use on the most exposed endpoints where the resilience benefit is not strictly required, if the application design allows it.
• Lower per-instance memory limits consciously and configure JVM max heap plus container memory limits so OOM conditions fail predictably and restart cleanly rather than destabilizing the node.
• Configure readiness/liveness probes and alerting on heap utilization trends so operators can shed load before an OOM crash.

2) Patch/upgrade steps

• No patched version exists per tracked sources. Monitor the SmallRye Fault Tolerance and Quarkus security advisories and release notes continuously.
• When a fix is published, upgrade the SmallRye Fault Tolerance dependency (and the Quarkus platform BOM that pins it) to the first fixed release, then rebuild and redeploy all affected services.
• Because the defect is per-request retention in the annotated code path, pay particular attention to release notes referencing object/state release, memory, or resource cleanup in fault-tolerance handling.

3) Long-term hardening

• Track Quarkus/SmallRye dependency versions as part of SBOM management and subscribe to upstream security advisories.
• Add sustained-load soak testing of retry/circuit-breaker endpoints with heap instrumentation to catch similar leaks before production.
• Establish continuous heap and GC telemetry with trending alerts, since slow-leak defects like this are best caught by memory-growth deviation rather than per-request signatures.
• Maintain defense-in-depth availability controls (autoscaling with sane bounds, circuit breakers upstream, global rate limiting) so a single leaking service cannot cascade.

References

• NVD — CVE-2026-94449: https://nvd.nist.gov/vuln/detail/CVE-2026-94449
• CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• SmallRye Fault Tolerance project documentation and advisories: https://github.com/smallrye/smallrye-fault-tolerance
• Quarkus security advisories and release notes: https://quarkus.io/security/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-94449 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code is available. No threat actor campaign or exploit-in-the-wild evidence has been identified. EPSS has not been scored by FIRST.org. Patch confidence is 0/4 and no vendor fix or workaround is currently published.