CVE-2025-2240: apicurio-registry
CVSS: 7.5v3.1HighDeferred
AliasesCGA-3v5w-539p-3rmhCGA-44cf-5w7g-gh83CGA-5fp3-68rm-j8hjCGA-8h89-vpqv-wpwjCGA-9hr5-mvvp-jxcjCGA-c8cp-93hq-pj6vCGA-gx3c-v6c5-c87qCGA-h7c5-c5r8-jjxxCGA-hpx9-37wh-ppcvCGA-jg4c-pvq8-8vvjCGA-mjqr-55vc-x8cfCGA-mr7m-m24f-54hfCGA-qp95-6vfc-rc92CGA-rx8w-jr5m-5hwjCGA-wc85-8g34-ch65CGA-xcwp-m6f8-px2xGHSA-gfh6-3pqw-x2j4
Published 12-03-2025Last modified 13-08-2026
Vulnerability summary
CVE-2025-2240 is a high (CVSS 7.5) vulnerability in apicurio-registry. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
1.02%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 12-03-2025PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.02%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
+0.02 pp
From 1.00% on 18-09-2026
18-09-202618-10-2026
EPSS score1.02%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- apicurio-registry< 3.0.6-r2
- apicurio-registry-nginx-config< 3.0.6-r2
- apicurio-registry-ui< 3.0.6-r2
- wildfly< 35.0.1-r14
- wildfly-openjdk-17< 35.0.1-r14
Wolfi8 products
- apicurio-registry< 3.0.6-r2
- apicurio-registry-nginx-config< 3.0.6-r2
- apicurio-registry-ui< 3.0.6-r2
- wildfly< 35.0.1-r14
- wildfly-openjdk-17< 35.0.1-r14
Io.smallrye1 product
- smallrye-fault-tolerance-core≥ 6.3.0, < 6.4.2 | ≥ 6.5.0, < 6.9.0
3 vendors · 17 products
