CVE-2025-49574

{
  "id": "CVE-2025-49574",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49574",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-24T13:32:59.683811Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "quarkusio",
          "product": "quarkus",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.21.0.CR1, < 3.24.1"
            },
            {
              "status": "affected",
              "version": ">= 3.16.0.CR1, < 3.20.2"
            },
            {
              "status": "affected",
              "version": "< 3.15.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-23T20:15:28.170",
  "references": [
    {
      "url": "https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/quarkusio/quarkus/issues/48227",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/quarkusio/quarkus/pull/48486",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/quarkusio/quarkus/releases/tag/3.24.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6."
    },
    {
      "lang": "es",
      "value": "Quarkus es un framework nativo de la nube (Linux) basado en contenedores para la escritura de aplicaciones Java. En versiones anteriores a la 3.24.0, existía una posible fuga de datos al duplicar un contexto duplicado. Quarkus utiliza ampliamente el contexto duplicado de Vert.x para implementar la propagación del contexto. Con la nueva semántica, los datos de una transacción pueden filtrarse a los de otra. Desde la perspectiva de Vert.x, esta nueva semántica clarifica el comportamiento. Una cantidad significativa de datos se almacena en el contexto duplicado, incluyendo el alcance de la solicitud, los detalles de seguridad y los metadatos. Duplicar un contexto duplicado es bastante inusual y solo ocurre en algunos lugares. Este problema se ha corregido en la versión 3.24.0. "
    }
  ],
  "lastModified": "2026-06-17T09:31:30.923",
  "sourceIdentifier": "security-advisories@github.com"
}