{"id":"CVE-2025-49574","state":"PUBLISHED","title":"Quarkus potential data leak when duplicating a duplicated context","description":"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.","publishedAt":"2025-06-23T19:47:05.454Z","updatedAt":"2025-12-22T18:40:19.531Z","severity":{"score":6.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["quarkusio quarkus"],"affected":[{"vendor":"quarkusio","product":"quarkus","versions":[{"version":">= 3.21.0.CR1, < 3.24.1","status":"affected"},{"version":">= 3.16.0.CR1, < 3.20.2","status":"affected"},{"version":"< 3.15.6","status":"affected"}]}],"references":["https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4","https://github.com/quarkusio/quarkus/issues/48227","https://github.com/quarkusio/quarkus/pull/48486","https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1","https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275","https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c","https://github.com/quarkusio/quarkus/releases/tag/3.24.1"],"weaknesses":["CWE-668"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/49xxx/CVE-2025-49574.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-49574","state":"PUBLISHED","datePublished":"2025-06-23T19:47:05.454Z","dateUpdated":"2025-12-22T18:40:19.531Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2025-06-06T15:44:21.555Z"},"containers":{"cna":{"title":"Quarkus potential data leak when duplicating a duplicated context","descriptions":[{"lang":"en","value":"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6."}],"affected":[{"vendor":"quarkusio","product":"quarkus","versions":[{"version":">= 3.21.0.CR1, < 3.24.1","status":"affected"},{"version":">= 3.16.0.CR1, < 3.20.2","status":"affected"},{"version":"< 3.15.6","status":"affected"}]}],"references":[{"url":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4","name":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/quarkusio/quarkus/issues/48227","name":"https://github.com/quarkusio/quarkus/issues/48227","tags":["x_refsource_MISC"]},{"url":"https://github.com/quarkusio/quarkus/pull/48486","name":"https://github.com/quarkusio/quarkus/pull/48486","tags":["x_refsource_MISC"]},{"url":"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1","name":"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1","tags":["x_refsource_MISC"]},{"url":"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275","name":"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275","tags":["x_refsource_MISC"]},{"url":"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c","name":"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c","tags":["x_refsource_MISC"]},{"url":"https://github.com/quarkusio/quarkus/releases/tag/3.24.1","name":"https://github.com/quarkusio/quarkus/releases/tag/3.24.1","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-668","lang":"en","description":"CWE-668: Exposure of Resource to Wrong Sphere","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2025-12-22T18:40:19.531Z"},"source":{"advisory":"GHSA-9623-mj7j-p9v4","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-24T13:32:59.683811Z","id":"CVE-2025-49574","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-24T13:33:07.194Z"}}]}}}