VDB
Sign up
HIGH8.3

GHSA-phg3-gv66-q38x

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

Quick fix

GHSA-phg3-gv66-q38x — io.quarkus:quarkus-rest: upgrade to the fixed version with the command below.

# pom.xml: bump <version>3.18.2</version> for io.quarkus:quarkus-rest

Details

A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/io.quarkus:quarkus-rest
Introduced in: 3.16.0.CR1Fixed in: 3.18.2
Fix# pom.xml: bump <version>3.18.2</version> for io.quarkus:quarkus-rest
Maven/io.quarkus:quarkus-rest-deployment
Introduced in: 3.16.0.CR1Fixed in: 3.18.2
Fix# pom.xml: bump <version>3.18.2</version> for io.quarkus:quarkus-rest-deployment
Maven/io.quarkus:quarkus-rest
Introduced in: 3.9.0.CR1Fixed in: 3.15.3.1
Fix# pom.xml: bump <version>3.15.3.1</version> for io.quarkus:quarkus-rest
Maven/io.quarkus:quarkus-rest-deployment
Introduced in: 3.9.0.CR1Fixed in: 3.15.3.1
Fix# pom.xml: bump <version>3.15.3.1</version> for io.quarkus:quarkus-rest-deployment
Maven/io.quarkus:quarkus-rest
Introduced in: 0Fixed in: 3.8.6.1
Fix# pom.xml: bump <version>3.8.6.1</version> for io.quarkus:quarkus-rest
Maven/io.quarkus:quarkus-rest-deployment
Introduced in: 0Fixed in: 3.8.6.1
Fix# pom.xml: bump <version>3.8.6.1</version> for io.quarkus:quarkus-rest-deployment

References