{"id":"CVE-2025-49574","summary":"Quarkus potential data leak when duplicating a duplicated context","details":"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.","aliases":["GHSA-9623-mj7j-p9v4"],"modified":"2026-07-22T04:02:10.912143Z","published":"2025-06-23T19:47:05.454Z","related":["CGA-82wq-f7p7-4gjx"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-668"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49574.json"},"references":[{"type":"WEB","url":"https://github.com/quarkusio/quarkus/releases/tag/3.24.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49574.json"},{"type":"ADVISORY","url":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49574"},{"type":"REPORT","url":"https://github.com/quarkusio/quarkus/issues/48227"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/pull/48486"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/quarkusio/quarkus","events":[{"introduced":"1336c91455a858b6b05d8472d2374514cf46b85a"},{"introduced":"88cac017173e088e982d1676394fc0c80beff256"},{"introduced":"0"},{"fixed":"4d05b77f0699f28c83acb2195eaaea4855119c46"},{"fixed":"d1a1739f3d14035670c1dcd294caeab0d153d79b"},{"fixed":"d82adb34dbca3a2160954499d856128b1a63b6bc"},{"fixed":"2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"},{"fixed":"31e8a3bfcf4e223788615d5ce25eb929ca251275"},{"fixed":"d1ee57e7b826872b6355cfec0ae13465840e232c"}],"database_specific":{"extracted_events":[{"introduced":"3.21.0.CR1"},{"fixed":"3.24.1"},{"introduced":"3.16.0.CR1"},{"fixed":"3.20.2"},{"introduced":"0"},{"fixed":"3.15.6"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49574.json","vanir_signatures_modified":"2026-07-22T04:02:10Z","vanir_signatures":[{"source":"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275","target":{"file":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/filters/AbstractResponseWrapper.java"},"deprecated":false,"digest":{"line_hashes":["256843998796959848504687037657153565150","286849916617719919808701982236741694604","139476835812070329847379078032297185599"],"threshold":0.9},"id":"CVE-2025-49574-9ca644cd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c","target":{"file":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/filters/AbstractResponseWrapper.java"},"deprecated":false,"digest":{"line_hashes":["256843998796959848504687037657153565150","286849916617719919808701982236741694604","139476835812070329847379078032297185599"],"threshold":0.9},"id":"CVE-2025-49574-ed874208","signature_type":"Line"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}