{"id":"GHSA-phg3-gv66-q38x","summary":"Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance","details":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","aliases":["CVE-2025-1247"],"modified":"2026-09-10T03:50:23.010626024Z","published":"2025-02-13T15:31:25Z","database_specific":{"github_reviewed_at":"2025-02-13T17:36:18Z","nvd_published_at":"2025-02-13T14:16:18Z","cwe_ids":["CWE-488"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1247"},{"type":"WEB","url":"https://github.com/quarkusio/quarkus/issues/45789"},{"type":"WEB","url":"https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53"},{"type":"WEB","url":"https://github.com/quarkusio/quarkus/commit/d8df15cec17dc5d085efc372d77cbef1341ae071"},{"type":"WEB","url":"https://github.com/quarkusio/quarkus/commit/f42166ee7041ed09b7183d5dbf3ece2439b16676"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2025:1884"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2025:1885"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2025:2067"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2025-1247"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345172"},{"type":"PACKAGE","url":"https://github.com/quarkusio/quarkus"},{"type":"WEB","url":"https://quarkus.io/blog/cve-fixes-feb-2025"}],"affected":[{"package":{"name":"io.quarkus:quarkus-rest","ecosystem":"Maven","purl":"pkg:maven/io.quarkus/quarkus-rest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0.CR1"},{"fixed":"3.18.2"}]}],"versions":["3.16.0","3.16.0.CR1","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0.CR1","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.0.CR1","3.18.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-phg3-gv66-q38x/GHSA-phg3-gv66-q38x.json"}},{"package":{"name":"io.quarkus:quarkus-rest-deployment","ecosystem":"Maven","purl":"pkg:maven/io.quarkus/quarkus-rest-deployment"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0.CR1"},{"fixed":"3.18.2"}]}],"versions":["3.16.0","3.16.0.CR1","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0.CR1","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.0.CR1","3.18.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-phg3-gv66-q38x/GHSA-phg3-gv66-q38x.json"}},{"package":{"name":"io.quarkus:quarkus-rest","ecosystem":"Maven","purl":"pkg:maven/io.quarkus/quarkus-rest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0.CR1"},{"fixed":"3.15.3.1"}]}],"versions":["3.10.0","3.10.0.CR1","3.10.1","3.10.2","3.11.0","3.11.0.CR1","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0.CR1","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.CR1","3.13.1","3.13.2","3.13.3","3.14.0","3.14.0.CR1","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0.CR1","3.15.1","3.15.2","3.15.3","3.9.0","3.9.0.CR1","3.9.0.CR2","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-phg3-gv66-q38x/GHSA-phg3-gv66-q38x.json"}},{"package":{"name":"io.quarkus:quarkus-rest-deployment","ecosystem":"Maven","purl":"pkg:maven/io.quarkus/quarkus-rest-deployment"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0.CR1"},{"fixed":"3.15.3.1"}]}],"versions":["3.10.0","3.10.0.CR1","3.10.1","3.10.2","3.11.0","3.11.0.CR1","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0.CR1","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.CR1","3.13.1","3.13.2","3.13.3","3.14.0","3.14.0.CR1","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0.CR1","3.15.1","3.15.2","3.15.3","3.9.0","3.9.0.CR1","3.9.0.CR2","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-phg3-gv66-q38x/GHSA-phg3-gv66-q38x.json"}},{"package":{"name":"io.quarkus:quarkus-rest","ecosystem":"Maven","purl":"pkg:maven/io.quarkus/quarkus-rest"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-phg3-gv66-q38x/GHSA-phg3-gv66-q38x.json"}},{"package":{"name":"io.quarkus:quarkus-rest-deployment","ecosystem":"Maven","purl":"pkg:maven/io.quarkus/quarkus-rest-deployment"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-phg3-gv66-q38x/GHSA-phg3-gv66-q38x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}]}