{"id":"CVE-2025-1247","state":"PUBLISHED","title":"Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","publishedAt":"2025-02-13T13:26:26.992Z","updatedAt":"2026-10-20T04:21:38.902Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","source":"redhat"},"assigner":"redhat","products":["quarkus-rest","Red Hat Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","Red Hat Red Hat build of Quarkus 3.15.3.SP1","Red Hat Red Hat build of Quarkus 3.8.6.SP3"],"affected":[{"packageName":"quarkus-rest","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.18.2","versionType":"semver"}],"collectionURL":"https://github.com/quarkusio/quarkus/"},{"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","packageName":"quarkus-rest","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3.15"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.15.3.SP1","packageName":"quarkus-rest","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3.15"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.8.6.SP3","packageName":"quarkus-rest","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3.8"]}],"references":["https://access.redhat.com/errata/RHSA-2025:1884","https://access.redhat.com/errata/RHSA-2025:1885","https://access.redhat.com/errata/RHSA-2025:2067","https://access.redhat.com/security/cve/CVE-2025-1247","https://bugzilla.redhat.com/show_bug.cgi?id=2345172","https://github.com/quarkusio/quarkus/issues/45789"],"weaknesses":["CWE-488"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1247.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-1247","state":"PUBLISHED","datePublished":"2025-02-13T13:26:26.992Z","dateUpdated":"2026-10-20T04:21:38.902Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-02-12T09:43:11.716Z"},"containers":{"cna":{"title":"Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance","descriptions":[{"lang":"en","value":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information."}],"affected":[{"packageName":"quarkus-rest","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.18.2","versionType":"semver"}],"collectionURL":"https://github.com/quarkusio/quarkus/"},{"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 4.8 for Quarkus 3.15","packageName":"quarkus-rest","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3.15"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.15.3.SP1","packageName":"quarkus-rest","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3.15"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.8.6.SP3","packageName":"quarkus-rest","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3.8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:1884","name":"RHSA-2025:1884","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1885","name":"RHSA-2025:1885","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2067","name":"RHSA-2025:2067","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-1247","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345172","name":"RHBZ#2345172","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/quarkusio/quarkus/issues/45789"}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-488","description":"Exposure of Data Element to Wrong Session","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-20T04:21:38.902Z"},"datePublic":"2025-02-12T00:00:00.000Z","x_redhatCweChain":"CWE-488: Exposure of Data Element to Wrong Session","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"timeline":[{"lang":"en","time":"2025-02-12T09:30:25.106Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-02-12T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-13T14:11:32.786242Z","id":"CVE-2025-1247","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-13T14:11:38.780Z"}}]}}}