CVE-2025-49574

Executive Summary

CVE-2025-49574 is a data leakage vulnerability in the Quarkus framework, a Cloud Native, Linux Container-first platform for Java applications. The flaw resides in the Vert.x duplicated context mechanism, which Quarkus uses extensively for context propagation. When a duplicated context is itself duplicated, semantic data from one transaction can leak into another transaction. This includes sensitive information such as request scope data, security details, and metadata. The vulnerability affects versions prior to 3.24.1, 3.20.2, and 3.15.6. The CVSS score is 6.4 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability is in the Quarkus framework, which is distributed via Maven Central and other Java package repositories. Organizations using Quarkus in their supply chain should verify their dependency versions and update to patched releases. The vulnerability does not directly affect NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is Medium due to the potential for data leakage across transactions, but the low EPSS score and lack of public exploits reduce immediate risk.

Deep Dive & Mechanics

Quarkus leverages Vert.x's duplicated context to propagate contextual data across asynchronous operations. The duplicated context is a copy of the original context, containing request-scoped beans, security principals, and other metadata. When a duplicated context is duplicated again (a rare operation), the new semantic data from one transaction can inadvertently be shared with another transaction. This occurs because the duplication process does not properly isolate the data, leading to cross-transaction contamination.

The vulnerability is triggered in specific code paths where context duplication is nested. For example, when handling concurrent requests or using certain reactive streams, the context may be duplicated multiple times. The leaked data can include:

• Request scope beans (e.g., user session data)
• Security details (e.g., authentication tokens, roles)
• Metadata (e.g., correlation IDs, headers)

This is a classic case of improper isolation in context propagation, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Vulnerable vs. Patched Code

The fix involves ensuring that when a duplicated context is duplicated again, the new context is a fresh copy that does not retain references to the original transaction's data. The patched code likely uses a deep copy or a new context creation mechanism instead of shallow duplication.

Vulnerable Code (Conceptual):

// In vulnerable versions, duplicating a duplicated context may share data
Context original = Vertx.currentContext();
Context dup1 = original.duplicate();
// dup1 contains data from original
Context dup2 = dup1.duplicate();
// dup2 may incorrectly share data with dup1 or original

Patched Code (Conceptual):

// In patched versions, duplication ensures isolation
Context original = Vertx.currentContext();
Context dup1 = original.duplicate();
// dup1 is isolated
Context dup2 = dup1.duplicate();
// dup2 is a fresh copy, not sharing data with dup1

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the vulnerability in a lab environment:

1. Set up a Quarkus application using a vulnerable version (e.g., 3.15.5).
2. Implement a reactive endpoint that duplicates the context multiple times.
3. Send concurrent requests and monitor for data leakage (e.g., session IDs appearing in wrong responses).

Example vulnerable endpoint:

@Path("/test")
public class TestResource {
    @GET
    @Produces(MediaType.TEXT_PLAIN)
    public Uni<String> test() {
        Context context = Vertx.currentContext();
        Context dup1 = context.duplicate();
        Context dup2 = dup1.duplicate();
        // Simulate data leakage
        return Uni.createFrom().item(() -> {
            // In vulnerable version, dup2 may contain data from another request
            return "Data: " + dup2.get("sensitive");
        });
    }
}

Blue Team

To detect exploitation attempts:

• Monitor for unusual patterns in context propagation logs.
• Use application performance monitoring (APM) tools to trace context duplication events.
• Implement runtime checks to ensure context isolation.

Indicators of Compromise (IOCs)

• Log Entries: Unexpected data appearing in context variables across different transactions.
• Network Traffic: Anomalous responses containing data from other users' sessions.
• Application Errors: Stack traces related to context duplication in Vert.x.

Detection Engineering

YARA Rule

rule CVE_2025_49574_Quarkus_Context_Leak {
    meta:
        description = "Detects vulnerable Quarkus versions with context duplication issue"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49574"
    strings:
        $vuln_version1 = "quarkus-3.15." ascii
        $vuln_version2 = "quarkus-3.20." ascii
        $vuln_version3 = "quarkus-3.24." ascii
        $context_dup = "duplicate" ascii
    condition:
        any of ($vuln_version*) and $context_dup
}

Sigma Rule

title: Quarkus Context Duplication Data Leak
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-49574 via context duplication logs
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: quarkus
detection:
    selection:
        EventID: 1001
        Message|contains: "duplicate"
    condition: selection
falsepositives:
    - Legitimate context duplication in non-vulnerable versions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49574 Quarkus Context Data Leak"; flow:to_server; content:"/test"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Quarkus to version 3.24.1, 3.20.2, or 3.15.6 or later.
2. Workaround: Avoid duplicating contexts in application code if possible.
3. Monitoring: Enable detailed logging for context operations and monitor for anomalies.
4. Network Segmentation: Limit exposure of vulnerable applications to untrusted networks.
5. Patch Management: Ensure all Quarkus dependencies are updated across the supply chain.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert