Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.quarkus:quarkus-rest

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9MavenPublished

    Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

    CVE-2025-66560 · GHSA-5rfx-cp42-p624

    Affected
    • Maven io.quarkus:quarkus-rest < 3.20.5; >= 3.21.0, < 3.27.2; >= 3.30.0, < 3.31.0
    Fixed in
    3.31.03.27.23.20.5· Vendor fix available
    Issue
    A vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written response chunks to be fully transmitted before proceeding. If the client connection is dropped during this waiting period, the associated worker thread is never released and becomes permanently blocked. Under sustained or repeated occurrences, this can exhaust the available worker threads, leading to degraded performance, or complete unavailability of the application. Workarounds For versions without the fix applied, it is recommended to implement a health check that monitors the status and saturation of the worker thread pool. This helps detect abnormal thread retention early and allows operators to take corrective action before the application’s responsiveness is impacted. Credits CVE reported by Shaswata Jash, Nokia

    Recommended action: Upgrade to 3.31.0, 3.27.2 or 3.20.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.3MavenPublished

    Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

    CVE-2025-1247 · GHSA-phg3-gv66-q38x

    Affected
    • Maven io.quarkus:quarkus-rest >= 3.16.0.CR1, < 3.18.2; >= 3.9.0.CR1, < 3.15.3.1; < 3.8.6.1
    Fixed in
    3.8.6.13.18.23.15.3.1· Vendor fix available
    Issue
    A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.

    Recommended action: Upgrade to 3.18.2, 3.15.3.1 or 3.8.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →