CVE-2025-1247 Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance
Attackers can access sensitive request parameters from other users due to shared instances in Quarkus REST endpoints lacking proper CDI scopes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1247?
CVE-2025-1247 is a high-severity vulnerability in Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, published on 13 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
Weakness: CWE-488
Which versions are affected by CVE-2025-1247?
12 open source packages ship an affected version, including io.quarkus:quarkus-rest and io.quarkus:quarkus-rest-deployment.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkus:quarkus-rest Maven | All versions | 3.8.6.1 |
io.quarkus:quarkus-rest Maven | All versions | 3.8.6.1 |
io.quarkus:quarkus-rest Maven | From 3.16.0.CR1 | 3.18.2 |
io.quarkus:quarkus-rest Maven | From 3.16.0.CR1 | 3.18.2 |
io.quarkus:quarkus-rest Maven | From 3.9.0.CR1 | 3.15.3.1 |
io.quarkus:quarkus-rest Maven | From 3.9.0.CR1 | 3.15.3.1 |
6 more packages
io.quarkus:quarkus-rest-deployment Maven | All versions | 3.8.6.1 |
io.quarkus:quarkus-rest-deployment Maven | All versions | 3.8.6.1 |
io.quarkus:quarkus-rest-deployment Maven | From 3.16.0.CR1 | 3.18.2 |
io.quarkus:quarkus-rest-deployment Maven | From 3.16.0.CR1 | 3.18.2 |
io.quarkus:quarkus-rest-deployment Maven | From 3.9.0.CR1 | 3.15.3.1 |
io.quarkus:quarkus-rest-deployment Maven | From 3.9.0.CR1 | 3.15.3.1 |
How do I fix CVE-2025-1247?
Upgrade io.quarkus:quarkus-rest to a fixed version for your release line: 3.8.6.1, 3.18.2 or 3.15.3.1.
Is CVE-2025-1247 being exploited?
There is no known exploitation of CVE-2025-1247 in the wild and no public exploit code.
Sources
Also known as GHSA-phg3-gv66-q38x.