PT-2025-6869 · Unknown · Quarkus Rest

Published 2025-02-13 · Updated 2025-03-03 · CVE-2025-1247

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Quarkus REST (affected versions not specified)

Description: A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This issue enables attackers to manipulate request data, impersonate users, or access sensitive information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-488

Related Identifiers

CVE-2025-1247

GHSA-PHG3-GV66-Q38X

Affected Products

Quarkus Rest

References · 18

• https://access.redhat.com/errata/RHSA-2025:1884 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:1885 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:2067 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-phg3-gv66-q38x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1247 · Security Note
• https://github.com/quarkusio/quarkus · Note
• https://github.com/quarkusio/quarkus/issues/45789 · Note
• https://github.com/quarkusio/quarkus/commit/d8df15cec17dc5d085efc372d77cbef1341ae071 · Note
• https://github.com/quarkusio/quarkus/commit/f42166ee7041ed09b7183d5dbf3ece2439b16676 · Note
• https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53 · Note
• https://quarkus.io/blog/cve-fixes-feb-2025 · Note
• https://t.me/cvenotify/113101 · Telegram Post
• https://t.me/cvenotify/112616 · Telegram Post
• https://t.me/cvenotify/112664 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2025-1247 · Note