GHSA-phg3-gv66-q38xHighCVSS 8.3

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

Published
February 13, 2025
Last Modified
March 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-1247 →

📋 Description

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

🎯 Affected products6

  • maven/io.quarkus:quarkus-rest:>= 3.16.0.CR1, < 3.18.2
  • maven/io.quarkus:quarkus-rest-deployment:>= 3.16.0.CR1, < 3.18.2
  • maven/io.quarkus:quarkus-rest:>= 3.9.0.CR1, < 3.15.3.1
  • maven/io.quarkus:quarkus-rest-deployment:>= 3.9.0.CR1, < 3.15.3.1
  • maven/io.quarkus:quarkus-rest:< 3.8.6.1
  • maven/io.quarkus:quarkus-rest-deployment:< 3.8.6.1

🔗 References (12)