CVE-2025-1247

Published: Feb 13, 2025Modified: Jun 17, 2026Deferred

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitability: 2.8 / Impact: 5.5

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

Related CWEs

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (6)

https://access.redhat.com/errata/RHSA-2025:1884

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:1885

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:2067

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-1247

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2345172

Source: secalert@redhat.com

https://github.com/quarkusio/quarkus/issues/45789

Source: secalert@redhat.com

Timeline

No history available yet.