CVE-2025-1247
Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
- Record
CVE-2025-1247- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-488
- Updated
- 2026-11-02
EUVDEUVD-2025-2099
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
- Record
EUVD-2025-2099- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-phg3-gv66-q38x
Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
- Record
GHSA-phg3-gv66-q38x- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-488
- Updated
- 2026-11-02
NVD
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
- Record
CVE-2025-1247- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-488
- Updated
- 2026-11-02
OSV
Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
- Record
CVE-2025-1247- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-488
- Updated
- 2026-11-02
OSVGHSA-phg3-gv66-q38x
Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
- Record
GHSA-phg3-gv66-q38x- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-488
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-restMaven |
3.16.0.CR1 up to 3.18.2 | 3.18.2 |
io.quarkus:quarkus-rest-deploymentMaven |
3.16.0.CR1 up to 3.18.2 | 3.18.2 |
io.quarkus:quarkus-restMaven |
3.9.0.CR1 up to 3.15.3.1 | 3.15.3.1 |
io.quarkus:quarkus-rest-deploymentMaven |
3.9.0.CR1 up to 3.15.3.1 | 3.15.3.1 |
io.quarkus:quarkus-restMaven |
before 3.8.6.1 | 3.8.6.1 |
io.quarkus:quarkus-rest-deploymentMaven |
before 3.8.6.1 | 3.8.6.1 |
io.quarkus:quarkus-restMaven |
3.16.0.CR1 up to 3.18.2, plus listed versions 3.16.03.16.13.16.23.16.33.16.4 Show 13 moreShow less3.17.03.17.0.CR13.17.13.17.23.17.33.17.43.17.53.17.63.17.73.17.83.18.03.18.0.CR13.18.1 |
3.18.2 |
io.quarkus:quarkus-rest-deploymentMaven |
3.16.0.CR1 up to 3.18.2, plus listed versions 3.16.03.16.13.16.23.16.33.16.4 Show 13 moreShow less3.17.03.17.0.CR13.17.13.17.23.17.33.17.43.17.53.17.63.17.73.17.83.18.03.18.0.CR13.18.1 |
3.18.2 |
io.quarkus:quarkus-restMaven |
3.9.0.CR1 up to 3.15.3.1, plus listed versions 3.10.03.10.0.CR13.10.13.10.23.11.0 Show 32 moreShow less3.11.0.CR13.11.13.11.23.11.33.12.03.12.0.CR13.12.13.12.23.12.33.13.03.13.0.CR13.13.13.13.23.13.33.14.03.14.0.CR13.14.13.14.23.14.33.14.43.15.03.15.0.CR13.15.13.15.23.15.33.9.03.9.0.CR23.9.13.9.23.9.33.9.43.9.5 |
3.15.3.1 |
io.quarkus:quarkus-rest-deploymentMaven |
3.9.0.CR1 up to 3.15.3.1, plus listed versions 3.10.03.10.0.CR13.10.13.10.23.11.0 Show 32 moreShow less3.11.0.CR13.11.13.11.23.11.33.12.03.12.0.CR13.12.13.12.23.12.33.13.03.13.0.CR13.13.13.13.23.13.33.14.03.14.0.CR13.14.13.14.23.14.33.14.43.15.03.15.0.CR13.15.13.15.23.15.33.9.03.9.0.CR23.9.13.9.23.9.33.9.43.9.5 |
3.15.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-1247 is a high vulnerability (CVSS 8.3) in Red Hat Build Of Apache Camel 4.8 For Quarkus 3.15, published February 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in io.quarkus:quarkus-rest 3.18.2.
References
access.redhat.com/errata/RHSA-2025:1884
bugzilla.redhat.com/show_bug.cgi?id=2345172
github.com/quarkusio/quarkus/issues/45789
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-1247
quarkus.io/blog/cve-fixes-feb-2025