CVE-2025-2240
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2025-2240 is a high-severity Improperly Controlled Sequential Memory Allocation (CWE-1325) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 41% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-6 (Resource Availability) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-2240, published on 2025-03-12, is a vulnerability in the Smallrye fault-tolerance component (smallrye-fault-tolerance) that causes an out-of-memory (OOM) condition. The flaw is externally triggered by calling the metrics URI, where each request creates a new object in the meterMap, potentially leading to a denial-of-service (DoS) condition. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1325.
Any unauthenticated attacker with network access to the affected metrics endpoint can exploit this vulnerability. Repeated calls to the URI enable unbounded object allocation in the meterMap, resulting in memory exhaustion and disruption of service availability, with no impact on confidentiality or integrity.
Red Hat has issued patches via errata RHSA-2025:3376, RHSA-2025:3541, and RHSA-2025:3543. Further details on the issue and remediation are documented in the Red Hat security advisory for CVE-2025-2240 and Bugzilla entry 2351452.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6307
Vulnerability Data
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of…
more
service (DoS) issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V2.4.1V13.1.2V13.2.6
Mitigating Controls (NIST 800-53 r5) AI
SC-6 directly enforces resource quotas and priority allocations that stop unbounded sequential memory requests from exhausting the system.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require developers to enforce total memory limits during sequential allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect unbounded allocation patterns, but removing the weakness does not fulfill testing obligations.
Secure development life cycle includes resource-management requirements that can prevent uncontrolled per-object allocations.
Secure architecture principles can mandate bounded resource usage, but eliminating this CWE does not address broader architectural controls.
Secure coding standards can require explicit limits on memory per object, yet fixing the weakness alone does not satisfy the full control.
Capacity management directly limits total memory consumption across objects, mitigating unbounded sequential allocations.