Quarkus potential data leak when duplicating a duplicated context
Published Jun 23, 2025
6.4
MEDIUMCVSS 3.1
EPSS 0.32%
Description
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.
Affected products
-
- Version < 3.15.6StatusaffectedConstraints-
- Version >= 3.16.0.CR1, < 3.20.2StatusaffectedConstraints-
- Version >= 3.21.0.CR1, < 3.24.1StatusaffectedConstraints-
- Version
No data.
No data.
Red Hat build of Quarkus 3.15.6
quarkus-bom
Fixed · RHSA-2025:13012
Red Hat build of Quarkus 3.20.2
quarkus-bom
Fixed · RHSA-2025:13010
Streams for Apache Kafka 3.0.0
n/a
Fixed · RHSA-2025:12511
Streams for Apache Kafka 3.1.0
quarkus-vertx
Fixed · RHSA-2025:23417
Cryostat 4
quarkus-vertx
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-ekb-dispatcher-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-ekb-kafka-controller-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-ekb-post-install-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-ekb-receiver-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-ekb-webhook-kafka-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel8
Fix deferred
OpenShift Serverless
openshift-serverless-1/kn-eventing-istio-controller-rhel8
Fix deferred
Red Hat Data Grid 8
quarkus-vertx
Fix deferred
Red Hat Fuse 7
quarkus-vertx
Fix deferred
Red Hat Integration Camel K 1
quarkus-vertx
Fix deferred
Red Hat JBoss Enterprise Application Platform 8
quarkus-vertx
Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack
quarkus-vertx
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-dashboard-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-trustyai-service-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-trustyai-service-rhel9
Fix deferred
Red Hat Process Automation 7
quarkus-vertx
Fix deferred
Red Hat build of Apache Camel - HawtIO 4
quarkus-vertx
Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3
quarkus-camel-bom
Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3
quarkus-cxf-bom
Fix deferred
Red Hat build of Apicurio Registry 2
quarkus-vertx
Fix deferred
Red Hat build of Apicurio Registry 3
quarkus-vertx
Fix deferred
Red Hat build of Debezium 2
quarkus-vertx
Fix deferred
Red Hat build of Debezium 3
quarkus-vertx
Fix deferred
Red Hat build of OptaPlanner 8
quarkus-vertx
Fix deferred
streams for Apache Kafka
quarkus-vertx
Fix deferred
streams for Apache Kafka 2
quarkus-vertx
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat build of Quarkus 3.15.6 | quarkus-bom | Fixed | RHSA-2025:13012 |
| Red Hat build of Quarkus 3.20.2 | quarkus-bom | Fixed | RHSA-2025:13010 |
| Streams for Apache Kafka 3.0.0 | n/a | Fixed | RHSA-2025:12511 |
| Streams for Apache Kafka 3.1.0 | quarkus-vertx | Fixed | RHSA-2025:23417 |
| Cryostat 4 | quarkus-vertx | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-ekb-dispatcher-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-ekb-kafka-controller-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-ekb-post-install-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-ekb-receiver-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-ekb-webhook-kafka-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-log-sink-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-timer-source-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel8 | Fix deferred | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-eventing-istio-controller-rhel8 | Fix deferred | n/a |
| Red Hat Data Grid 8 | quarkus-vertx | Fix deferred | n/a |
| Red Hat Fuse 7 | quarkus-vertx | Fix deferred | n/a |
| Red Hat Integration Camel K 1 | quarkus-vertx | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform 8 | quarkus-vertx | Fix deferred | n/a |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | quarkus-vertx | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-trustyai-service-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-trustyai-service-rhel9 | Fix deferred | n/a |
| Red Hat Process Automation 7 | quarkus-vertx | Fix deferred | n/a |
| Red Hat build of Apache Camel - HawtIO 4 | quarkus-vertx | Fix deferred | n/a |
| Red Hat build of Apache Camel 4 for Quarkus 3 | quarkus-camel-bom | Fix deferred | n/a |
| Red Hat build of Apache Camel 4 for Quarkus 3 | quarkus-cxf-bom | Fix deferred | n/a |
| Red Hat build of Apicurio Registry 2 | quarkus-vertx | Fix deferred | n/a |
| Red Hat build of Apicurio Registry 3 | quarkus-vertx | Fix deferred | n/a |
| Red Hat build of Debezium 2 | quarkus-vertx | Fix deferred | n/a |
| Red Hat build of Debezium 3 | quarkus-vertx | Fix deferred | n/a |
| Red Hat build of OptaPlanner 8 | quarkus-vertx | Fix deferred | n/a |
| streams for Apache Kafka | quarkus-vertx | Fix deferred | n/a |
| streams for Apache Kafka 2 | quarkus-vertx | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Jun 24, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.
Score over time
2025-2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed. Showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 4, 2026 | 0.32% (0.00317) | 22.44th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.25% (0.00250) | 16.01th | v5 (v2026.06.15) |
| Jun 24, 2025 | 0.02% (0.00017) | 2.41th | v4 (v2025.03.14) |
References (12)
- https://access.redhat.com/security/cve/CVE-2025-49574 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2374376 Issue Tracking
- https://github.com/advisories/GHSA-9623-mj7j-p9v4 Advisory
- https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1 x_refsource_MISC
- https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275 x_refsource_MISC
- https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c x_refsource_MISC
- https://github.com/quarkusio/quarkus/issues/48227 x_refsource_MISC
- https://github.com/quarkusio/quarkus/pull/48486 x_refsource_MISC
- https://github.com/quarkusio/quarkus/releases/tag/3.24.1 x_refsource_MISC
- https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2025-49574
- https://www.cve.org/CVERecord?id=CVE-2025-49574
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2025-49574 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2374376 | Issue Tracking | |
| https://github.com/advisories/GHSA-9623-mj7j-p9v4 | Advisory | |
| https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1 | x_refsource_MISC | |
| https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275 | x_refsource_MISC | |
| https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c | x_refsource_MISC | |
| https://github.com/quarkusio/quarkus/issues/48227 | x_refsource_MISC | |
| https://github.com/quarkusio/quarkus/pull/48486 | x_refsource_MISC | |
| https://github.com/quarkusio/quarkus/releases/tag/3.24.1 | x_refsource_MISC | |
| https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4 | x_refsource_CONFIRM | |
| https://nvd.nist.gov/vuln/detail/CVE-2025-49574 | ||
| https://www.cve.org/CVERecord?id=CVE-2025-49574 |
Change history (0)
No recorded changes yet.