Is io.quarkus:quarkus-rest affected by CVE-2025-1247?

Maven io.quarkus:quarkus-rest is affected in >=3.16.0.CR1 =3.9.0.CR1 <3.15.3.1, <3.8.6.1.

Is CVE-2025-1247 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.7%.

high

CVE-2025-1247

Q: Is CVE-2025-1247 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.7%.

Maven · io.quarkus:quarkus-rest • Maven · io.quarkus:quarkus-rest-deployment

Summary

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

Severity: high
EPSS: 0.7% (p49)
Also known as: GHSA-phg3-gv66-q38x#io.quarkus:quarkus-rest, GHSA-phg3-gv66-q38x#io.quarkus:quarkus-rest-deployment
Published: 2025-02-13

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1247
https://github.com/quarkusio/quarkus/issues/45789
https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53

Related advisories

CVE-2025-66560 — medium · Maven/io.quarkus:quarkus-rest

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.