Bug 2374376 (CVE-2025-49574)

Summary:	CVE-2025-49574 io.quarkus/quarkus-vertx: Quarkus potential data leak
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abrianik, anstephe, asoldano, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, caswilli, ccranfor, cdewolf, chfoley, clement.escoffier, cmah, cmiranda, dandread, darran.lofthouse, dhanak, dkreling, dosoudil, drosa, dsimansk, eaguilar, ebaron, eric.wittmann, fjuma, fmongiar, ggrzybek, gmalinko, gsmet, gtanzill, ibek, istudens, ivassile, iweiss, janstey, jbuscemi, jkoehler, jmartisk, jnethert, jolong, jpechane, jrokos, jsamir, jscholz, kaycoth, kingland, kverlaen, lgao, lphiri, lthon, manderse, matzew, mnovotny, mosmerov, msochure, msvehla, nipatil, nwallace, olubyans, pantinor, parichar, pbizzarr, pcongius, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rkubis, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, smaestri, sthirugn, swoodman, tasato, tom.jenkinson, tqvarnst, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be unintentionally exposed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-06-23 20:01:20 UTC

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.0, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.0.

Comment 2 errata-xmlrpc 2025-08-01 17:43:21 UTC

This issue has been addressed in the following products:

  Streams for Apache Kafka 3.0.0

Via RHSA-2025:12511 https://access.redhat.com/errata/RHSA-2025:12511