{"id":"CVE-2025-49574","aliases":["GHSA-9623-mj7j-p9v4"],"url":"https://o3.security/vulnerability/CVE-2025-49574","summary":"Quarkus potential data leak when duplicating a duplicated context","details":"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.","published":"2025-06-23T19:47:05.454Z","modified":"2026-07-22T04:02:10.912143Z","cvss":{"score":6.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.quarkus:quarkus-vertx","fixedVersion":"3.15.6"},{"ecosystem":"Maven","name":"io.quarkus:quarkus-vertx","fixedVersion":"3.20.2"},{"ecosystem":"Maven","name":"io.quarkus:quarkus-vertx","fixedVersion":"3.24.1"}],"fix":{"url":"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1","label":"quarkusio/quarkus@2b58f59"},"references":[{"type":"WEB","url":"https://github.com/quarkusio/quarkus/releases/tag/3.24.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49574.json"},{"type":"ADVISORY","url":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-9623-mj7j-p9v4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49574"},{"type":"REPORT","url":"https://github.com/quarkusio/quarkus/issues/48227"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/commit/2b58f59f4bf0bae7d35b1abb585b65f2a66787d1"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/commit/31e8a3bfcf4e223788615d5ce25eb929ca251275"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/commit/d1ee57e7b826872b6355cfec0ae13465840e232c"},{"type":"FIX","url":"https://github.com/quarkusio/quarkus/pull/48486"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-22T04:02:10.912143Z"}}