CVE-2025-1247
Fixed in a distro release EPSS <1%CVSS 8.3
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
Products: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15, Red Hat build of Quarkus 3.15.3.SP1, Red Hat build of Quarkus 3.8.6.SP3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.quarkus:quarkus-rest | 3.18.2 |
| Maven | io.quarkus:quarkus-rest | 3.15.3.1 |
| Maven | io.quarkus:quarkus-rest | 3.8.6.1 |
| Maven | io.quarkus:quarkus-rest-deployment | 3.18.2 |
| Maven | io.quarkus:quarkus-rest-deployment | 3.15.3.1 |
| Maven | io.quarkus:quarkus-rest-deployment | 3.8.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak | 26.1.3-r0 |
| Wolfi | keycloak | 26.1.3-r0 |