Quarkus potentially leaks data when duplicating a duplicated context

Impact Vert.x 4.5.12 has changed the semantics of the duplication of duplicated context. Duplicated context is an object used to propagate data through a processing synchronous or asynchronous. Each "transaction" or "processing" runs on its own isolated duplicated context. Initially, duplicating ...

Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications open-sourced by Quarkus. A security vulnerability exists in Quarkus versions prior to 3.24.0 that stems from a potential data leak when copying duplicate contexts...

PT-2025-26642 · Quarkus · Quarkus

Name of the Vulnerable Software and Affected Versions: Quarkus versions prior to 3.24.0 Description: The issue is related to a potential data leak when duplicating a duplicated context in Quarkus, which extensively uses the Vert.x duplicated context to implement context propagation. This can caus...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available (RHBQ 3.20.1.SP1)

An update for Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available RHBQ 3.20.1.SP1. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.20.1 release

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

io.quarkus:quarkus-vertx-http-deployment (>=2.13.0.cr1, <=3.3.3) potentially affected by CVE-2025-47204 via org.webjars:bootstrap-multiselect (0.9.15)

org.webjars:bootstrap-multiselect MAVEN version 0.9.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:bootstrap-multiselect and may be impacted: - io.quarkus:quarkus-vertx-http-deployment =2.13.0.cr1, =3.3.3 Source cves: CVE-2025-47204...

CVE-2024-12225

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

CVE-2024-12225

CVE-2024-12225 affects Quarkus, specifically the quarkus-security-webauthn module. The vulnerability arises because default REST endpoints for user registration/login remain accessible when developers add custom endpoints, potentially allowing an attacker to obtain a login cookie with no correspo...

CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass

A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in while allowing developers to provide custom REST endpoints. When developers provide custom REST endpoints, the default...

Quarkus 安全漏洞

Quarkus is a cloud-native Linux container-first framework for writing Java applications from the Quarkus open source. A security vulnerability exists in Quarkus that stems from an undisabled default REST endpoint in the quarkus-security-webauthn module, which could lead to arbitrary user login...

PT-2025-19841

Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description A vulnerability was found in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and logging users in, and when developers provi...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.4.GA)

An update for Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available RHBQ 3.15.4.GA. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.15.4 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

io.micronaut.testresources:micronaut-test-resources-infinispan (>=3.0.0-m5, <=4.0.0-m1), io.quarkus:quarkus-test-infinispan-client (>=2.5.0.cr1, <=3.2.0.final) +54 more potentially affected by CVE-2024-6875 via org.infinispan:infinispan-server-rest (>=7.0.0.cr1, <=16.3.0.dev01)

org.infinispan:infinispan-server-rest MAVEN version =7.0.0.cr1, =3.0.0-m5, =2.5.0.cr1, =8.0.0.beta1, =7.0.0.cr1, =15.0.14.final, =9.3.0.cr1, =9.3.0.cr1, =8.0.0.alpha1, =9.0.0.beta1, =9.0.0.beta1, =15.0.0.cr1, =15.0.0.cr1, =12.1.1.final, =12.1.1.final, =16.2.2 and more Source cves: CVE-2024-6875...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=6.1.1), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0, <=1.0.0) +30 more potentially affected by CVE-2024-11735 via org.keycloak:keycloak-quarkus-server (>=12.0.0, <=26.7.2)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.0, =26.2.0, =26.7.2 and more...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of HTTP metrics. An attacker can cause a denial of service by sending crafted requests that lead to metrics explosion. Remediation There is no fixed versi...

Moderate: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.3.SP2)

An update for Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available RHBQ 3.15.3.SP2. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...