Vulnerability-Lookup

CVE-2025-49574 (GCVE-0-2025-49574)

Vulnerability from cvelistv5 – Published: 2025-06-23 19:47 – Updated: 2025-12-22 18:40

Title

Quarkus potential data leak when duplicating a duplicated context

Summary

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.

Severity ?

6.4 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-668 - Exposure of Resource to Wrong Sphere

Assigner

GitHub_M

References

URL

Tags

	https://github.com/quarkusio/quarkus/security/adv…	x_refsource_CONFIRM
	https://github.com/quarkusio/quarkus/issues/48227	x_refsource_MISC
	https://github.com/quarkusio/quarkus/pull/48486	x_refsource_MISC
	https://github.com/quarkusio/quarkus/commit/2b58f…	x_refsource_MISC
	https://github.com/quarkusio/quarkus/commit/31e8a…	x_refsource_MISC
	https://github.com/quarkusio/quarkus/commit/d1ee5…	x_refsource_MISC
	https://github.com/quarkusio/quarkus/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	quarkusio	quarkus	Affected: >= 3.21.0.CR1, < 3.24.1 Affected: >= 3.16.0.CR1, < 3.20.2 Affected: < 3.15.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-49574",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-24T13:32:59.683811Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-24T13:33:07.194Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quarkus",
          "vendor": "quarkusio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.21.0.CR1, \u003c 3.24.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.16.0.CR1, \u003c 3.20.2"
            },
            {
              "status": "affected",
              "version": "\u003c 3.15.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668: Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-22T18:40:19.531Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"
        },
        {
          "name": "https://github.com/quarkusio/quarkus/issues/48227",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkusio/quarkus/issues/48227"
        },
        {
          "name": "https://github.com/quarkusio/quarkus/pull/48486",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkusio/quarkus/pull/48486"
        },
        {
          "name": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"
        },
        {
          "name": "https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275"
        },
        {
          "name": "https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c"
        },
        {
          "name": "https://github.com/quarkusio/quarkus/releases/tag/3.24.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quarkusio/quarkus/releases/tag/3.24.1"
        }
      ],
      "source": {
        "advisory": "GHSA-9623-mj7j-p9v4",
        "discovery": "UNKNOWN"
      },
      "title": "Quarkus potential data leak when duplicating a duplicated context"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-49574",
    "datePublished": "2025-06-23T19:47:05.454Z",
    "dateReserved": "2025-06-06T15:44:21.555Z",
    "dateUpdated": "2025-12-22T18:40:19.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-49574\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-24T13:32:59.683811Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-24T13:33:03.488Z\"}}], \"cna\": {\"title\": \"Quarkus potential data leak when duplicating a duplicated context\", \"source\": {\"advisory\": \"GHSA-9623-mj7j-p9v4\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.4, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"quarkusio\", \"product\": \"quarkus\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.21.0.CR1, \u003c 3.24.1\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.16.0.CR1, \u003c 3.20.2\"}, {\"status\": \"affected\", \"version\": \"\u003c 3.15.6\"}]}], \"references\": [{\"url\": \"https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4\", \"name\": \"https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/quarkusio/quarkus/issues/48227\", \"name\": \"https://github.com/quarkusio/quarkus/issues/48227\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/quarkusio/quarkus/pull/48486\", \"name\": \"https://github.com/quarkusio/quarkus/pull/48486\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1\", \"name\": \"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275\", \"name\": \"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c\", \"name\": \"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/quarkusio/quarkus/releases/tag/3.24.1\", \"name\": \"https://github.com/quarkusio/quarkus/releases/tag/3.24.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-668\", \"description\": \"CWE-668: Exposure of Resource to Wrong Sphere\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-12-22T18:40:19.531Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-49574\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-12-22T18:40:19.531Z\", \"dateReserved\": \"2025-06-06T15:44:21.555Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-06-23T19:47:05.454Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-49574

Vulnerability from fkie_nvd - Published: 2025-06-23 20:15 - Updated: 2025-12-22 19:15

Severity ?

6.4 (Medium) - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1
	security-advisories@github.com	https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275
	security-advisories@github.com	https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c
	security-advisories@github.com	https://github.com/quarkusio/quarkus/issues/48227
	security-advisories@github.com	https://github.com/quarkusio/quarkus/pull/48486
	security-advisories@github.com	https://github.com/quarkusio/quarkus/releases/tag/3.24.1
	security-advisories@github.com	https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6."
    },
    {
      "lang": "es",
      "value": "Quarkus es un framework nativo de la nube (Linux) basado en contenedores para la escritura de aplicaciones Java. En versiones anteriores a la 3.24.0, exist\u00eda una posible fuga de datos al duplicar un contexto duplicado. Quarkus utiliza ampliamente el contexto duplicado de Vert.x para implementar la propagaci\u00f3n del contexto. Con la nueva sem\u00e1ntica, los datos de una transacci\u00f3n pueden filtrarse a los de otra. Desde la perspectiva de Vert.x, esta nueva sem\u00e1ntica clarifica el comportamiento. Una cantidad significativa de datos se almacena en el contexto duplicado, incluyendo el alcance de la solicitud, los detalles de seguridad y los metadatos. Duplicar un contexto duplicado es bastante inusual y solo ocurre en algunos lugares. Este problema se ha corregido en la versi\u00f3n 3.24.0. "
    }
  ],
  "id": "CVE-2025-49574",
  "lastModified": "2025-12-22T19:15:48.903",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-23T20:15:28.170",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/issues/48227"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/pull/48486"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/releases/tag/3.24.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9623-MJ7J-P9V4

Vulnerability from github – Published: 2025-06-23 18:53 – Updated: 2025-12-22 18:38

Summary

Quarkus potentially leaks data when duplicating a duplicated context

Details

Impact

Vert.x 4.5.12 has changed the semantics of the duplication of duplicated context.

Duplicated context is an object used to propagate data through a processing (synchronous or asynchronous). Each "transaction" or "processing" runs on its own isolated duplicated context.

Initially, duplicating a duplicated context was creating a fresh (empty) new context, meaning that the new duplicated context can be used to managed a separated transaction.

In Vert.x 4.5.12, this semantics has changed, and since the content of the parent duplicated context is copied into the new one, potentially leaking data.

This CVE is especially for Quarkus as Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior.

A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places:

Quarkus REST Client when using OTel (but it's the same transaction, so no leak)
Quarkus Messaging connectors
Quarkus SmallRye Health (same transaction, so no leak)

Patches

After discussion with the Vert.x team, the change will be rolled back in Vert.x 4.x. A new API will be added to Vert.x 5 do distinguish the 2 cases.

Workarounds

When duplicating a duplicated context, the following code can be done to avoid the potential leak:

((ContextInternal) VertxContext.getRootContext(ctx)).duplicate()

This workaround would not be required once the Vert.x version containing the fix will be included. Note that the workaround would still work.

References

This issue have been reported in https://github.com/quarkusio/quarkus/issues/48227.

Severity ?

6.4 (Medium)


                  
                    CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.15.5"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.20.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.16.0.CR1"
            },
            {
              "fixed": "3.20.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.24.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-vertx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.21.0.CR1"
            },
            {
              "fixed": "3.24.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49574"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-23T18:53:22Z",
    "nvd_published_at": "2025-06-23T20:15:28Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nVert.x 4.5.12 has changed the semantics of the duplication of duplicated context.\n\nDuplicated context is an object used to propagate data through a processing (synchronous or asynchronous). Each \"transaction\" or \"processing\" runs on its own isolated duplicated context.\n\nInitially, duplicating a duplicated context was creating a fresh (empty) new context, meaning that the new duplicated context can be used to managed a separated transaction.\n\nIn Vert.x 4.5.12, this semantics has changed, and since the content of the parent duplicated context is copied into the new one, potentially leaking data. \n\nThis CVE is especially for Quarkus as Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. \n\nA significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places:\n\n- Quarkus REST Client when using OTel (but it\u0027s the same transaction, so no leak)\n- Quarkus Messaging connectors\n- Quarkus SmallRye Health (same transaction, so no leak)\n\n\n\n### Patches\n\nAfter discussion with the Vert.x team, the change will be rolled back in Vert.x 4.x. A new API will be added to Vert.x 5 do distinguish the 2 cases.\n\n### Workarounds\n\nWhen duplicating a duplicated context, the following code can be done to avoid the potential leak:\n\n```java\n((ContextInternal) VertxContext.getRootContext(ctx)).duplicate()\n```\n\nThis workaround would not be required once the Vert.x version containing the fix will be included. Note that the workaround would still work. \n\n\n### References\n\nThis issue have been reported in https://github.com/quarkusio/quarkus/issues/48227.",
  "id": "GHSA-9623-mj7j-p9v4",
  "modified": "2025-12-22T18:38:56Z",
  "published": "2025-06-23T18:53:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/issues/48227"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/pull/48486"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quarkusio/quarkus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/releases/tag/3.24.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quarkus potentially leaks data when duplicating a duplicated context"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-49574 (GCVE-0-2025-49574)

FKIE_CVE-2025-49574

GHSA-9623-MJ7J-P9V4

Impact

Patches

Workarounds

References

Tags

Sightings

Nomenclature