CVE-2023-6393 MEDIUM

CVE-2023-6393: Quarkus: potential invalid reuse of context when @cacheresult on a uni is used

Vendor Red Hat
Product Red Hat build of Quarkus
Weakness CWE-200 · Info exposure
Published December 6, 2023
Last update November 20, 2025

CVSS base score

5.3/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the cached Uni context contains sensitive information, and could allow a malicious user to benefit from a POST request returning the response that is meant for another user, gaining access to sensitive data.

Key dates

02Disclosure timeline

December 6, 2023 CVE published
November 20, 2025 Record updated