8.3 Élevée

CVE-2025-1247 A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use…

Description

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Red Hat Build of Apache Camel 4.8 for Quarkus 3.15	Versions non publiées
Red Hat build of Quarkus 3.15.3.SP1	Versions non publiées
Red Hat build of Quarkus 3.8.6.SP3	Versions non publiées

Références

RHSA-2025:1884 access.redhat.com
RHSA-2025:1885 access.redhat.com
RHSA-2025:2067 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2345172 bugzilla.redhat.com
github.com github.com

Chronologie

Publiée 13 février 2025
Dernière modification 20 octobre 2026

Les 3 CVE de Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 →

CVE-2025-2240 Smallrye-fault-tolerance: smallrye fault tolerance 7.5 Élevée CVE-2025-1634 A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are… 7.5 Élevée

Suivre cette CVE