CVE-2025-1634

Overview

Quarkus is a Kubernetes-native Java framework optimized for cloud-native applications, containers, and serverless workloads. It is designed around fast startup, low memory use, build-time processing, and developer-friendly integrations across REST, HTTP, security, data, messaging, and observability extensions.

A Denial of Service (DoS) vulnerability (CVE-2025-1634) has been identified in Quarkus RESTEasy Classic, which allows attackers to exhaust application memory by repeatedly opening requests and closing them before the server finishes sending the response. When client request timeouts cause the underlying Vert.x response to close early, Quarkus can skip the output-stream cleanup path and retain response buffers until memory pressure causes the application to fail.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource unavailable for the purpose it was designed.

This issue affects multiple versions of Quarkus RESTEasy Classic in the io.quarkus:quarkus-resteasy package.

‍

Details

Module Info

• Product: Quarkus
• Affected packages: io.quarkus:quarkus-resteasy
• Affected versions: <3.8.6.1, >=3.9.0.CR1 <3.15.3.1, >=3.16.0.CR1 <3.19.1
• GitHub repository: https://github.com/quarkusio/quarkus
• Published packages: https://central.sonatype.com/artifact/io.quarkus/quarkus-resteasy
• Package manager: Maven
• Fixed in: NES for Quarkus 2.16.x

Vulnerability Info

This High-severity vulnerability is found in the io.quarkus:quarkus-resteasy package in multiple versions of Quarkus. The vulnerable code is in RESTEasy Classic's Vert.x-backed response adapter, where VertxHttpResponse.finish() returns immediately if the response has already finished, ended, or closed:

public void finish() throws IOException {
    checkException();
    if (finished || response.ended() || response.closed())
        return;
    try {
        if (os != null) {
            os.close(); // this will end() vertx response

When a client closes the connection before receiving a response, such as by using a low request timeout, the underlying Vert.x response can be marked closed before finish() reaches the normal output-stream cleanup block. The early return bypasses os.close(), leaving the RESTEasy output stream and its buffers alive longer than intended. Repeated aborted requests can accumulate these unreleased buffers and eventually cause an OutOfMemoryError, resulting in denial of service. Successful exploitation requires a Quarkus application using RESTEasy Classic and a request path that performs enough response work for repeated client-side timeouts to retain memory. Quarkus REST is not affected by this RESTEasy Classic code path.

‍

Mitigation

Only recent versions of Quarkus are community-supported. The affected 2.16.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade Quarkus to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.