{"id":"CVE-2025-1247","aliases":["EUVD-2025-2099","GHSA-phg3-gv66-q38x"],"status":"published","title":"Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00819,"percentile":0.57514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-488"],"published":"2025-02-13T13:26:26Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Maven","package":"io.quarkus:quarkus-rest","fixed_in":["3.18.2","3.15.3.1","3.8.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","fixed_in":["3.18.2","3.15.3.1","3.8.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0.CR1"},{"fixed":"3.18.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0.CR1"},{"fixed":"3.18.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0.CR1"},{"fixed":"3.15.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0.CR1"},{"fixed":"3.15.3.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0.CR1"},{"fixed":"3.18.2"}]}],"versions":["3.16.0","3.16.0.CR1","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0.CR1","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.0.CR1","3.18.1"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0.CR1"},{"fixed":"3.18.2"}]}],"versions":["3.16.0","3.16.0.CR1","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0.CR1","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.0.CR1","3.18.1"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0.CR1"},{"fixed":"3.15.3.1"}]}],"versions":["3.10.0","3.10.0.CR1","3.10.1","3.10.2","3.11.0","3.11.0.CR1","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0.CR1","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.CR1","3.13.1","3.13.2","3.13.3","3.14.0","3.14.0.CR1","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0.CR1","3.15.1","3.15.2","3.15.3","3.9.0","3.9.0.CR1","3.9.0.CR2","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0.CR1"},{"fixed":"3.15.3.1"}]}],"versions":["3.10.0","3.10.0.CR1","3.10.1","3.10.2","3.11.0","3.11.0.CR1","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0.CR1","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.CR1","3.13.1","3.13.2","3.13.3","3.14.0","3.14.0.CR1","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0.CR1","3.15.1","3.15.2","3.15.3","3.9.0","3.9.0.CR1","3.9.0.CR2","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-rest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-rest-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat build of apache camel 4.8 for quarkus 3.15"},{"vendor":"red hat","product":"red hat build of quarkus 3.15.3.sp1"},{"vendor":"red hat","product":"red hat build of quarkus 3.8.6.sp3"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:1884","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1885","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:2067","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-1247","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345172","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/quarkusio/quarkus/issues/45789","tags":["report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1247","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53","tags":["web"]},{"url":"https://github.com/quarkusio/quarkus/commit/d8df15cec17dc5d085efc372d77cbef1341ae071","tags":["web"]},{"url":"https://github.com/quarkusio/quarkus/commit/f42166ee7041ed09b7183d5dbf3ece2439b16676","tags":["web"]},{"url":"https://quarkus.io/blog/cve-fixes-feb-2025","tags":["web"]},{"url":"https://github.com/advisories/GHSA-phg3-gv66-q38x"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/quarkusio/quarkus/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1247.json","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-1247","title":"Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","status":"published","published":"2025-02-13T13:26:26.992Z","modified":"2026-10-20T04:21:38.902Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T14:32:49.503917Z"}],"euvd":[{"id":"EUVD-2025-2099","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","status":"published","published":"2025-02-13T13:26:26Z","modified":"2026-10-20T04:21:38Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:59:44.419021Z"}],"ghsa":[{"id":"GHSA-phg3-gv66-q38x","title":"Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","status":"published","published":"2025-02-13T15:31:25Z","modified":"2025-03-03T15:32:40Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2025-1247","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","status":"published","published":"2025-02-13T14:16:18.4Z","modified":"2026-10-20T05:16:53.223Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"CVE-2025-1247","title":"Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","status":"published","published":"2025-02-13T13:26:26.992Z","modified":"2026-10-28T02:31:00.934908181Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"GHSA-phg3-gv66-q38x","title":"Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance","description":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.","status":"published","published":"2025-02-13T15:31:25Z","modified":"2026-09-10T03:50:23.010626024Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-488"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}