~ / search / GHSA-phg3-gv66-q38x

GHSA-phg3-gv66-q38x

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

Source: GitHub Advisory Database (reviewed) High CVE-2025-1247

Packages

EcosystemPackageAffectedFixed in
Maven io.quarkus:quarkus-rest >= 3.16.0.CR1, < 3.18.2 3.18.2
Maven io.quarkus:quarkus-rest-deployment >= 3.16.0.CR1, < 3.18.2 3.18.2
Maven io.quarkus:quarkus-rest >= 3.9.0.CR1, < 3.15.3.1 3.15.3.1
Maven io.quarkus:quarkus-rest-deployment >= 3.9.0.CR1, < 3.15.3.1 3.15.3.1
Maven io.quarkus:quarkus-rest < 3.8.6.1 3.8.6.1
Maven io.quarkus:quarkus-rest-deployment < 3.8.6.1 3.8.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

References

External links from the advisory. They lead to third-party sites.