Read the docs
TI-2025-01067 Aliases CVE-2025-1247GHSA-phg3-gv66-q38x

Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance

Priority MEDIUM 40CWE-488Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00819 57th percentileScored 2026-11-07
Fix Fixed quarkus-rest: 3.18.2io.quarkus:quarkus-rest (Maven): 3.18.2, 3.15.3.1, 3.8.6.1+1 more productRed Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—quarkus-restbefore 3.18.23.18.2Patch availableCNA
Red HatRed Hat Build of Apache Camel 4.8 for Quarkus 3.15——Not affectedCNA
Red HatRed Hat build of Quarkus 3.15.3.SP1——Not affectedCNA
Red HatRed Hat build of Quarkus 3.8.6.SP3——Not affectedCNA
—io.quarkus:quarkus-rest (Maven)3.16.0.CR1 to before 3.18.23.18.2Patch availableGHSA-phg3-gv66-q38x
—io.quarkus:quarkus-rest-deployment (Maven)3.16.0.CR1 to before 3.18.23.18.2Patch availableGHSA-phg3-gv66-q38x
—io.quarkus:quarkus-rest (Maven)3.9.0.CR1 to before 3.15.3.13.15.3.1Patch availableGHSA-phg3-gv66-q38x
—io.quarkus:quarkus-rest-deployment (Maven)3.9.0.CR1 to before 3.15.3.13.15.3.1Patch availableGHSA-phg3-gv66-q38x
—io.quarkus:quarkus-rest (Maven)before 3.8.6.13.8.6.1Patch availableGHSA-phg3-gv66-q38x
—io.quarkus:quarkus-rest-deployment (Maven)before 3.8.6.13.8.6.1Patch availableGHSA-phg3-gv66-q38x
  • quarkus-rest Vendor— Affected before 3.18.2 Fixed in 3.18.2 Patch available CNA
  • Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Quarkus 3.15.3.SP1 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat build of Quarkus 3.8.6.SP3 VendorRed Hat Affected — Fixed in — Not affected CNA
  • io.quarkus:quarkus-rest (Maven) Vendor— Affected 3.16.0.CR1 to before 3.18.2 Fixed in 3.18.2 Patch available GHSA-phg3-gv66-q38x
  • io.quarkus:quarkus-rest-deployment (Maven) Vendor— Affected 3.16.0.CR1 to before 3.18.2 Fixed in 3.18.2 Patch available GHSA-phg3-gv66-q38x
  • io.quarkus:quarkus-rest (Maven) Vendor— Affected 3.9.0.CR1 to before 3.15.3.1 Fixed in 3.15.3.1 Patch available GHSA-phg3-gv66-q38x
  • io.quarkus:quarkus-rest-deployment (Maven) Vendor— Affected 3.9.0.CR1 to before 3.15.3.1 Fixed in 3.15.3.1 Patch available GHSA-phg3-gv66-q38x
  • io.quarkus:quarkus-rest (Maven) Vendor— Affected before 3.8.6.1 Fixed in 3.8.6.1 Patch available GHSA-phg3-gv66-q38x
  • io.quarkus:quarkus-rest-deployment (Maven) Vendor— Affected before 3.8.6.1 Fixed in 3.8.6.1 Patch available GHSA-phg3-gv66-q38x

CPE names CNA · 3

CPEVersionsRoleVendor
cpe:/a:redhat:camel_quarkus:3.153.15—Red Hat
cpe:/a:redhat:quarkus:3.153.15—Red Hat
cpe:/a:redhat:quarkus:3.83.8—Red Hat
  • cpe:/a:redhat:camel_quarkus:3.15 Versions 3.15 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.15 Versions 3.15 — ·Red Hat
  • cpe:/a:redhat:quarkus:3.8 Versions 3.8 — ·Red Hat

Remediation

  • Fix · CNA quarkus-rest Fixed in 3.18.2
  • Fix · GHSA-phg3-gv66-q38x io.quarkus:quarkus-rest (Maven) Fixed in 3.18.2 Advisory →
  • Fix · GHSA-phg3-gv66-q38x io.quarkus:quarkus-rest-deployment (Maven) Fixed in 3.18.2 Advisory →
  • Fix · GHSA-phg3-gv66-q38x io.quarkus:quarkus-rest (Maven) Fixed in 3.15.3.1 Advisory →
  • Fix · GHSA-phg3-gv66-q38x io.quarkus:quarkus-rest-deployment (Maven) Fixed in 3.15.3.1 Advisory →
  • Fix · GHSA-phg3-gv66-q38x io.quarkus:quarkus-rest (Maven) Fixed in 3.8.6.1 Advisory →
  • Fix · GHSA-phg3-gv66-q38x io.quarkus:quarkus-rest-deployment (Maven) Fixed in 3.8.6.1 Advisory →

Red Hat 3 advisories

  • RHSA-2025:2067 Released 2025-03-03 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.3.SP1)
    • Red Hat Build of Apache Camel 4.8 for Quarkus 3.15
  • RHSA-2025:1884 Released 2025-02-27 · Red Hat rating Important
    Red Hat build of Quarkus 3.8.6.SP3 Security Update
    • Red Hat build of Quarkus 3.8.6.SP3
  • RHSA-2025:1885 Released 2025-02-27 · Red Hat rating Important
    Red Hat build of Quarkus 3.15.3.SP1 Security Update
    • Red Hat build of Quarkus 3.15.3.SP1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Apache Camel 4.8 for Quarkus 3.15Fixed RHSA-2025:2067
Red Hat build of Quarkus 3.15.3.SP1Fixed RHSA-2025:1885
Red Hat build of Quarkus 3.8.6.SP3Fixed RHSA-2025:1884

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1247
  2. 2026-10-03 Alias added: GHSA-phg3-gv66-q38x
  3. 2026-10-05 Priority changed: LOW → MEDIUM

References

Advisory 4

Other 8

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences