CVE-2025-1247

What it actually does

Race condition in Quarkus REST permits request parameters to leak across concurrent requests when field injection is used without a CDI scope, enabling cross-request data manipulation.

Why it matters to the business

Organizations may face unauthorized data exposure, user impersonation, or integrity violations in applications handling sensitive requests, increasing risk of compliance violations and operational disruption until addressed.

How an attack unfolds

An attacker identifies endpoints using field injection without proper CDI scoping, then issues multiple overlapping requests to trigger parameter leakage, allowing manipulation of request data from other users or sessions to impersonate or access restricted information.

How to fix it

Ensure all endpoints using field injection are annotated with an appropriate CDI scope such as @RequestScoped; monitor for and apply Quarkus REST updates when a patched version becomes available.

How to confirm the fix worked

Audit source code for field-injected beans lacking CDI scopes; perform load testing with concurrent requests to verify parameter isolation; review application logs for unexpected cross-request data.

Typical attack path

1. Map application endpoints that rely on field injection
2. Craft and send concurrent requests targeting the same endpoint
3. Observe leaked parameters from one request appearing in another
4. Leverage leaked data to impersonate users or access sensitive resources

How to detect it

Examine application and framework logs for concurrent request handling anomalies or parameter values appearing in unexpected sessions; correlate request IDs with response contents for leakage indicators.

What your security team should do

• Prioritize code review of REST endpoints for missing CDI scopes
• Implement request-scoped beans as a temporary mitigation
• Subscribe to Quarkus security advisories for patch availability
• Increase monitoring of concurrent request patterns in production