CVE-2025-1247: Quarkus REST Endpoint Request Parameter Leakage Vulnerability
Summary
CVE-2025-1247: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance. Affects io.quarkus:quarkus-rest across 3 version ranges.
< 3.8.6.1
>= 3.9.0.CR1, < 3.15.3.1
>= 3.16.0.CR1, < 3.18.2
Fixed in 3.8.6.1, 3.15.3.1 or 3.18.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Quarkus is a Kubernetes-native Java framework tailored for GraalVM and OpenJDK HotSpot, designed to create lightweight, high-performance applications. It offers a range of features including RESTful APIs, reactive programming, and dependency injection. However, a critical vulnerability has been identified in its REST module, where request parameters can leak between concurrent requests due to improper field injection without a CDI scope.
Vulnerability Detail
The vulnerability arises from the use of field injection in Quarkus REST endpoints without a proper CDI (Contexts and Dependency Injection) scope. This flaw allows request parameters to be shared across different requests, potentially enabling attackers to manipulate request data, impersonate users, or access sensitive information. The severity of this issue is underscored by its CVSS score of 8.3, indicating a high risk to applications utilizing the affected packages.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.8.6.13.8.6.1 -
>= 3.9.0.CR1, < 3.15.3.13.15.3.1 -
>= 3.16.0.CR1, < 3.18.23.18.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can avoid using field injection for request parameters and instead utilize method parameters or constructor injection to ensure that each request is handled independently, thus preventing parameter leakage.
Conclusion
The Quarkus REST Endpoint Request Parameter Leakage vulnerability (CVE-2025-1247) poses a significant risk to applications using the affected packages. It is crucial to update to the patched version to mitigate potential security threats. Additionally, developers should consider implementing workarounds to enhance security until the update is applied.
See every vulnerability recorded for io.quarkus:quarkus-rest →
FAQ
CVE-2025-1247 is a vulnerability in Quarkus REST that allows request parameters to leak between concurrent requests due to improper field injection.
Attackers could manipulate request data, impersonate users, or access sensitive information, posing a significant security risk.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without any signup.
The recommended action is to update the affected packages to version 3.18.2 or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.quarkus:quarkus-rest.
