{"id":"CVE-2025-1247","title":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope","summary":"A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, …","severity":"high","cvss":8.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cwe":["CWE-488"],"published":"2025-02-13","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-1247","references":[{"url":"https://access.redhat.com/errata/RHSA-2025:1884","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:1885","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:2067","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2025-1247","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345172","label":"secalert@redhat.com"},{"url":"https://github.com/quarkusio/quarkus/issues/45789","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-1247.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1247"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1247"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00819,"epssPercentile":0.57,"ingestedAt":"2026-08-04T09:39:29.900Z","vendor":"Red Hat","product":"quarkus-rest","affected":["quarkus-rest < 3.18.2","quarkus-rest","quarkus-rest","quarkus-rest"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-02-13T14:11:32.786242Z"},"patched":["build_of_apache_camel_4_8_for_quarkus 3.15","build_of_quarkus 3.15.3.SP1","build_of_quarkus 3.8.6.SP3"],"slug":"CVE-2025-1247","body":"## Overview\n\nA flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:2067** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 · released 2025-03-03 · [advisory](https://access.redhat.com/errata/RHSA-2025:2067)\n- **RHSA-2025:1885** · Red Hat · fixed in: Red Hat build of Quarkus 3.15.3.SP1 · released 2025-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2025:1885)\n- **RHSA-2025:1884** · Red Hat · fixed in: Red Hat build of Quarkus 3.8.6.SP3 · released 2025-02-27 · [advisory](https://access.redhat.com/errata/RHSA-2025:1884)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}