CVE-2025-49574: Quarkus potentially leaks data when duplicating a duplicated context
6.4
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.quarkus:quarkus-vertx | maven | <= 3.15.5 | |
| io.quarkus:quarkus-vertx | maven | >= 3.16.0.CR1, <= 3.20.1 | |
| io.quarkus:quarkus-vertx | maven | >= 3.21.0.CR1, < 3.24.0 | 3.24.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability exists due to a change in the behavior of Vert.x's Context.duplicate() method in version 4.5.12. Previously, duplicating an already duplicated context would result in a new, empty context. The change caused it to inherit data from the parent context, leading to potential data leakage between different transactions in Quarkus applications, which rely heavily on this mechanism for context propagation, especially in reactive messaging.
The provided patch addresses the issue by upgrading the Vert.x dependency to version 4.5.16, where this semantic change was rolled back. Concurrently, the Quarkus code was updated to avoid relying on this implicit behavior.
The analysis of the commit 2b58f59f4bf0bae7d35b1abb585b65f2a66787d1 points to io.quarkus.smallrye.reactivemessaging.runtime.ContextualEmitterImpl.sendMessage as the key function. This function is part of the reactive messaging system and is responsible for propagating context when sending messages. The patch modifies this function to introduce a new helper method, createContextualMessage, which explicitly controls the duplication of the context and the copying of local data. This change ensures that even with the reverted (and now correct) behavior in Vert.x, the intended context propagation for the emitter works as expected without leaking unintended data from other transactions. The vulnerability is triggered when an application uses this emitter, as it would invoke the faulty context duplication logic in the vulnerable Vert.x versions.