CVE-2025-1247 HIGH

CVE-2025-1247: Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance

Vendor Red Hat
Product Red Hat Build of Apache Camel 4.8 for Quarkus 3.15
Weakness CWE-488
Published February 13, 2025
Last update March 23, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

What the vulnerability does

01Description

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

Key dates

02Disclosure timeline

February 13, 2025 CVE published
March 23, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking CVE-2024-27935 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination CVE-2023-1907 Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session CVE-2024-11094 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure CVE-2025-2312 cifs.upcall makes an upcall to the wrong namespace in containerized environments