FKIE_CVE-2025-49574

Vulnerability from fkie_nvd - Published: 2025-06-23 20:15 - Updated: 2025-12-22 19:15
Severity ?
6.4 (Medium) - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.
References
security-advisories@github.comhttps://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1
security-advisories@github.comhttps://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275
security-advisories@github.comhttps://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c
security-advisories@github.comhttps://github.com/quarkusio/quarkus/issues/48227
security-advisories@github.comhttps://github.com/quarkusio/quarkus/pull/48486
security-advisories@github.comhttps://github.com/quarkusio/quarkus/releases/tag/3.24.1
security-advisories@github.comhttps://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6."
    },
    {
      "lang": "es",
      "value": "Quarkus es un framework nativo de la nube (Linux) basado en contenedores para la escritura de aplicaciones Java. En versiones anteriores a la 3.24.0, exist\u00eda una posible fuga de datos al duplicar un contexto duplicado. Quarkus utiliza ampliamente el contexto duplicado de Vert.x para implementar la propagaci\u00f3n del contexto. Con la nueva sem\u00e1ntica, los datos de una transacci\u00f3n pueden filtrarse a los de otra. Desde la perspectiva de Vert.x, esta nueva sem\u00e1ntica clarifica el comportamiento. Una cantidad significativa de datos se almacena en el contexto duplicado, incluyendo el alcance de la solicitud, los detalles de seguridad y los metadatos. Duplicar un contexto duplicado es bastante inusual y solo ocurre en algunos lugares. Este problema se ha corregido en la versi\u00f3n 3.24.0. "
    }
  ],
  "id": "CVE-2025-49574",
  "lastModified": "2025-12-22T19:15:48.903",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-23T20:15:28.170",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/issues/48227"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/pull/48486"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/releases/tag/3.24.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.