PT-2025-26642 · Quarkus+1 · Quarkus+1

Markusdlugi · Published 2025-06-23 · Updated 2025-11-01 · CVE-2025-49574

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Quarkus versions prior to 3.24.0

Description: The issue is related to a potential data leak when duplicating a duplicated context in Quarkus, which extensively uses the Vert.x duplicated context to implement context propagation. This can cause data from one transaction to leak into another. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rare and only occurs in a few places.

Recommendations: For versions prior to 3.24.0, update to version 3.24.0 to resolve the issue. As a temporary workaround, consider restricting the use of context duplication to minimize the risk of data leakage.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ALT-PU-2025-10780

ALT-PU-2025-13422

CVE-2025-49574

ECHO-49D8-EE3F-6DE3

GHSA-9623-MJ7J-P9V4

Affected Products

Alt Linux

Quarkus

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49574.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49574 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49574 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9623-mj7j-p9v4 · Vendor Advisory
• https://github.com/quarkusio/quarkus · Note
• https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c · Note
• https://github.com/quarkusio/quarkus/releases/tag/3.24.1 · Note
• https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275 · Note
• https://github.com/quarkusio/quarkus/pull/48486 · Note
• https://github.com/quarkusio/quarkus/issues/48227 · Note
• https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1 · Note
• https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4 · Note
• https://twitter.com/CVEnew/status/1937243793608040495 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1937253122801328562 · Twitter Post
• https://t.me/cvetracker/26872 · Telegram Post