CVE-2025-1247: Exposure of Data Element to Wrong Session
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
AI Analysis
Technical Summary
The vulnerability CVE-2025-1247 affects Red Hat build of Quarkus REST endpoints that use field injection without a CDI scope, leading to leakage of request parameters between concurrent requests. This shared instance issue can result in unauthorized data exposure and potential user impersonation. The flaw is rated with a CVSS 3.1 score of 8.3 (high severity) indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity with low impact on availability. Red Hat has issued security advisories RHSA-2025:1884 and RHSA-2025:1885 that provide updates fixing this vulnerability in Quarkus versions 3.8.6.SP3 and 3.15.3.SP1 respectively.
Potential Impact
Successful exploitation of this vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information due to leakage of request parameters between concurrent sessions. The confidentiality and integrity of data are highly impacted, while availability impact is low. This can lead to unauthorized access and potential compromise of user sessions.
Mitigation Recommendations
Red Hat has released official security updates addressing this vulnerability in Red Hat build of Quarkus versions 3.8.6.SP3 and 3.15.3.SP1. Users should apply these updates promptly. Before applying these updates, ensure all previously released errata relevant to your system are applied. Refer to Red Hat's official advisories (RHSA-2025:1884 and RHSA-2025:1885) and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation guidance.
CVE-2025-1247: Exposure of Data Element to Wrong Session
Description
A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.
CVSS v3.1
Score 8.3high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2025-1247 affects Red Hat build of Quarkus REST endpoints that use field injection without a CDI scope, leading to leakage of request parameters between concurrent requests. This shared instance issue can result in unauthorized data exposure and potential user impersonation. The flaw is rated with a CVSS 3.1 score of 8.3 (high severity) indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity with low impact on availability. Red Hat has issued security advisories RHSA-2025:1884 and RHSA-2025:1885 that provide updates fixing this vulnerability in Quarkus versions 3.8.6.SP3 and 3.15.3.SP1 respectively.
Potential Impact
Successful exploitation of this vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information due to leakage of request parameters between concurrent sessions. The confidentiality and integrity of data are highly impacted, while availability impact is low. This can lead to unauthorized access and potential compromise of user sessions.
Mitigation Recommendations
Red Hat has released official security updates addressing this vulnerability in Red Hat build of Quarkus versions 3.8.6.SP3 and 3.15.3.SP1. Users should apply these updates promptly. Before applying these updates, ensure all previously released errata relevant to your system are applied. Refer to Red Hat's official advisories (RHSA-2025:1884 and RHSA-2025:1885) and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation guidance.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- redhat
- Date Reserved
- 2025-02-12T09:43:11.716Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2025:1884","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:1885","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:2067","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2025-1247","vendor":"Red Hat"}]
Threat ID: 68af0c87ad5a09ad00627bd4
Added to database: 08/27/2025, 13:47:51 UTC
Last enriched: 08/04/2026, 13:10:27 UTC
Last updated: 09/10/2026, 19:24:55 UTC
Views: 275
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.