{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una falla en Quarkus REST que permite que los par\u00e1metros de solicitud se filtren entre solicitudes concurrentes si los endpoints usan la inyecci\u00f3n de campos sin un alcance CDI. Esta vulnerabilidad permite a los atacantes manipular los datos de la solicitud, hacerse pasar por usuarios o acceder a informaci\u00f3n confidencial."
    }
  ],
  "id": "CVE-2025-1247",
  "lastModified": "2025-03-03T14:15:34.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-02-13T14:16:18.400",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:1884"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:1885"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2025:2067"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2025-1247"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-488"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.16.0.CR1"
            },
            {
              "fixed": "3.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-rest-deployment"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.16.0.CR1"
            },
            {
              "fixed": "3.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.0.CR1"
            },
            {
              "fixed": "3.15.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-rest-deployment"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.0.CR1"
            },
            {
              "fixed": "3.15.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-rest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.quarkus:quarkus-rest-deployment"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-1247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-488"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-13T17:36:18Z",
    "nvd_published_at": "2025-02-13T14:16:18Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.",
  "id": "GHSA-phg3-gv66-q38x",
  "modified": "2025-03-03T15:31:24Z",
  "published": "2025-02-13T15:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/issues/45789"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/02ff9ed45c3928edf2a0f8b906543606fed7cd53"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/d8df15cec17dc5d085efc372d77cbef1341ae071"
    },
    {
      "type": "WEB",
      "url": "https://github.com/quarkusio/quarkus/commit/f42166ee7041ed09b7183d5dbf3ece2439b16676"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:1884"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:1885"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2025:2067"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-1247"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/quarkusio/quarkus"
    },
    {
      "type": "WEB",
      "url": "https://quarkus.io/blog/cve-fixes-feb-2025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.3.SP1).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products.\nRed Hat Product Security has rated this update as having a security impact of Important.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "An update for Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.3.SP1).\nThe purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products:\n* quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout (CVE-2025-1634)\n* io.quarkus/quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance (CVE-2025-1247)\n* io.netty/netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine (CVE-2025-24970)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:2067",
        "url": "https://access.redhat.com/errata/RHSA-2025:2067"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-1634",
        "url": "https://access.redhat.com/security/cve/CVE-2025-1634"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-1247",
        "url": "https://access.redhat.com/security/cve/CVE-2025-1247"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-24970",
        "url": "https://access.redhat.com/security/cve/CVE-2025-24970"
      },
      {
        "category": "external",
        "summary": "2344787",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
      },
      {
        "category": "external",
        "summary": "2345172",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
      },
      {
        "category": "external",
        "summary": "2347319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2067.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 update is now available (RHBQ 3.15.3.SP1)",
    "tracking": {
      "current_release_date": "2026-02-18T16:50:11+00:00",
      "generator": {
        "date": "2026-02-18T16:50:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2025:2067",
      "initial_release_date": "2025-03-03T13:23:22+00:00",
      "revision_history": [
        {
          "date": "2025-03-03T13:23:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-03-03T13:23:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-18T16:50:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15",
                "product": {
                  "name": "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15",
                  "product_id": "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:3.15"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-1247",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2025-02-12T09:30:25.106000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2345172"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability marked as important severity rather than moderate because it leads to cross-request data leakage, which can compromise the confidentiality and integrity of user interactions. In a concurrent environment, multiple requests being served by a single, shared instance of an endpoint class means that sensitive request data\u2014such as authentication headers, cookies, or form parameters\u2014can be inadvertently exposed to other users. This violates fundamental HTTP request isolation principles, potentially leading to session hijacking, unauthorized access, or privilege escalation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1247"
        },
        {
          "category": "external",
          "summary": "RHBZ#2345172",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1247",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1247"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247"
        }
      ],
      "release_date": "2025-02-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-03T13:23:22+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance"
    },
    {
      "cve": "CVE-2025-1634",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-02-24T14:17:31.237000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2347319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is marked as and Important severity rather than Moderate because it allows an unauthenticated attacker to trigger a denial of service  condition by repeatedly sending crafted HTTP requests with low timeouts. The issue leads to a memory leak that cannot be recovered without restarting the application, ultimately resulting in an OutOfMemoryError  and complete service failure.\n\nIn a production environment, this vulnerability poses a significant risk to availability, especially for applications handling multiple concurrent requests. Since no mitigation exists, all applications using quarkus-resteasy are affected until patched. The ease of exploitation, lack of required privileges, and high impact on service uptime justify the high severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "RHBZ#2347319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1634",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634"
        }
      ],
      "release_date": "2025-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-03T13:23:22+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout"
    },
    {
      "cve": "CVE-2025-24970",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2025-02-10T23:00:52.785132+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty\u0027s SslHandler is of important severity rather than moderate because it directly impacts the stability and reliability of applications using native SSLEngine. By sending a specially crafted packet, an attacker can trigger a native crash, leading to a complete process termination. Unlike typical moderate vulnerabilities that might cause limited disruptions or require specific conditions, this flaw can be exploited remotely to induce a Denial of Service (DoS), affecting high-availability systems and mission-critical services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-24970",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
          "url": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw"
        }
      ],
      "release_date": "2025-02-10T21:57:28.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-03T13:23:22+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:2067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of Apache Camel 4.8 for Quarkus 3.15"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus. \nRed Hat Product Security has rated this update as having an important security impact.\nA Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability.\nFor more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.8.6.SP3 contains security updates. For more information, see the release notes\npage listed in the References section.\n\nSecurity Fix(es):\n\n* io.netty/netty-handler: SslHandler doesn\u0027t correctly validate packets, which can lead to a native crash when using native SSLEngine (CVE-2025-24970)\n\n* io.quarkus/quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance (CVE-2025-1247)\n\n* io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout (CVE-2025-1634)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:1884",
        "url": "https://access.redhat.com/errata/RHSA-2025:1884"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2344787",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
      },
      {
        "category": "external",
        "summary": "2345172",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
      },
      {
        "category": "external",
        "summary": "2347319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1884.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.8.6.SP3 Security Update",
    "tracking": {
      "current_release_date": "2026-02-18T16:49:36+00:00",
      "generator": {
        "date": "2026-02-18T16:49:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2025:1884",
      "initial_release_date": "2025-02-27T15:15:05+00:00",
      "revision_history": [
        {
          "date": "2025-02-27T15:15:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-02-27T15:15:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-18T16:49:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.8.6.SP3",
                "product": {
                  "name": "Red Hat build of Quarkus 3.8.6.SP3",
                  "product_id": "Red Hat build of Quarkus 3.8.6.SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-1247",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2025-02-12T09:30:25.106000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2345172"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability marked as important severity rather than moderate because it leads to cross-request data leakage, which can compromise the confidentiality and integrity of user interactions. In a concurrent environment, multiple requests being served by a single, shared instance of an endpoint class means that sensitive request data\u2014such as authentication headers, cookies, or form parameters\u2014can be inadvertently exposed to other users. This violates fundamental HTTP request isolation principles, potentially leading to session hijacking, unauthorized access, or privilege escalation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8.6.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1247"
        },
        {
          "category": "external",
          "summary": "RHBZ#2345172",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1247",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1247"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247"
        }
      ],
      "release_date": "2025-02-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-27T15:15:05+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1884"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance"
    },
    {
      "cve": "CVE-2025-1634",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-02-24T14:17:31.237000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2347319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is marked as and Important severity rather than Moderate because it allows an unauthenticated attacker to trigger a denial of service  condition by repeatedly sending crafted HTTP requests with low timeouts. The issue leads to a memory leak that cannot be recovered without restarting the application, ultimately resulting in an OutOfMemoryError  and complete service failure.\n\nIn a production environment, this vulnerability poses a significant risk to availability, especially for applications handling multiple concurrent requests. Since no mitigation exists, all applications using quarkus-resteasy are affected until patched. The ease of exploitation, lack of required privileges, and high impact on service uptime justify the high severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8.6.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "RHBZ#2347319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1634",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634"
        }
      ],
      "release_date": "2025-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-27T15:15:05+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1884"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout"
    },
    {
      "cve": "CVE-2025-24970",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2025-02-10T23:00:52.785132+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty\u0027s SslHandler is of important severity rather than moderate because it directly impacts the stability and reliability of applications using native SSLEngine. By sending a specially crafted packet, an attacker can trigger a native crash, leading to a complete process termination. Unlike typical moderate vulnerabilities that might cause limited disruptions or require specific conditions, this flaw can be exploited remotely to induce a Denial of Service (DoS), affecting high-availability systems and mission-critical services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.8.6.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-24970",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
          "url": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw"
        }
      ],
      "release_date": "2025-02-10T21:57:28.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-27T15:15:05+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1884"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.8.6.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having an important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability.\nFor more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat Build of Quarkus 3.15.3.SP1 includes security updates.\nFor more information, see the release notes page listed in the References section.\n\nSecurity Fix(es):\n\n* io.netty/netty-handler: SslHandler doesn\u0027t correctly validate packets, which can lead to a native crash when using native SSLEngine (CVE-2025-24970)\n\n* io.quarkus/quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance (CVE-2025-1247)\n\n* io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout (CVE-2025-1634)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:1885",
        "url": "https://access.redhat.com/errata/RHSA-2025:1885"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2344787",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
      },
      {
        "category": "external",
        "summary": "2345172",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
      },
      {
        "category": "external",
        "summary": "2347319",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1885.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.15.3.SP1 Security Update",
    "tracking": {
      "current_release_date": "2026-02-18T16:49:37+00:00",
      "generator": {
        "date": "2026-02-18T16:49:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2025:1885",
      "initial_release_date": "2025-02-27T13:16:16+00:00",
      "revision_history": [
        {
          "date": "2025-02-27T13:16:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-02-27T13:16:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-18T16:49:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.15.3.SP1",
                "product": {
                  "name": "Red Hat build of Quarkus 3.15.3.SP1",
                  "product_id": "Red Hat build of Quarkus 3.15.3.SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.15::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-1247",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2025-02-12T09:30:25.106000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2345172"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This vulnerability allows attackers to manipulate request data, impersonate users, or access sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability marked as important severity rather than moderate because it leads to cross-request data leakage, which can compromise the confidentiality and integrity of user interactions. In a concurrent environment, multiple requests being served by a single, shared instance of an endpoint class means that sensitive request data\u2014such as authentication headers, cookies, or form parameters\u2014can be inadvertently exposed to other users. This violates fundamental HTTP request isolation principles, potentially leading to session hijacking, unauthorized access, or privilege escalation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.15.3.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1247"
        },
        {
          "category": "external",
          "summary": "RHBZ#2345172",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345172"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1247",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1247"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1247"
        }
      ],
      "release_date": "2025-02-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-27T13:16:16+00:00",
          "details": "Before applying this update, ensure that all previously released errata relevant to your system are applied.  \n\nFor details about applying this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1885"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-rest: Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance"
    },
    {
      "cve": "CVE-2025-1634",
      "cwe": {
        "id": "CWE-401",
        "name": "Missing Release of Memory after Effective Lifetime"
      },
      "discovery_date": "2025-02-24T14:17:31.237000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2347319"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is marked as and Important severity rather than Moderate because it allows an unauthenticated attacker to trigger a denial of service  condition by repeatedly sending crafted HTTP requests with low timeouts. The issue leads to a memory leak that cannot be recovered without restarting the application, ultimately resulting in an OutOfMemoryError  and complete service failure.\n\nIn a production environment, this vulnerability poses a significant risk to availability, especially for applications handling multiple concurrent requests. Since no mitigation exists, all applications using quarkus-resteasy are affected until patched. The ease of exploitation, lack of required privileges, and high impact on service uptime justify the high severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.15.3.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "RHBZ#2347319",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2347319"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-1634",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-1634"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1634"
        }
      ],
      "release_date": "2025-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-27T13:16:16+00:00",
          "details": "Before applying this update, ensure that all previously released errata relevant to your system are applied.  \n\nFor details about applying this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1885"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout"
    },
    {
      "cve": "CVE-2025-24970",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2025-02-10T23:00:52.785132+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2344787"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s SslHandler. This vulnerability allows a native crash via a specially crafted packet that bypasses proper validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty\u0027s SslHandler is of important severity rather than moderate because it directly impacts the stability and reliability of applications using native SSLEngine. By sending a specially crafted packet, an attacker can trigger a native crash, leading to a complete process termination. Unlike typical moderate vulnerabilities that might cause limited disruptions or require specific conditions, this flaw can be exploited remotely to induce a Denial of Service (DoS), affecting high-availability systems and mission-critical services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.15.3.SP1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "RHBZ#2344787",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344787"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-24970",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24970"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4",
          "url": "https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw"
        }
      ],
      "release_date": "2025-02-10T21:57:28.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-27T13:16:16+00:00",
          "details": "Before applying this update, ensure that all previously released errata relevant to your system are applied.  \n\nFor details about applying this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1885"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.15.3.SP1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty:netty-handler: SslHandler doesn\u0027t correctly validate packets which can lead to native crash when using native SSLEngine"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in Quarkus auf Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, oder einen Denial of Service auszul\u00f6sen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-0460 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0460.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-0460 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0460"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:1884 vom 2025-02-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:1884"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:1885 vom 2025-02-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:1885"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:2067 vom 2025-03-03",
        "url": "https://access.redhat.com/errata/RHSA-2025:2067"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:2663 vom 2025-03-11",
        "url": "https://access.redhat.com/errata/RHSA-2025:2663"
      },
      {
        "category": "external",
        "summary": "Bamboo Data Center Advisory",
        "url": "https://jira.atlassian.com/browse/BAM-26046"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:3358 vom 2025-03-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:3358"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:3357 vom 2025-03-27",
        "url": "https://access.redhat.com/errata/RHSA-2025:3357"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7229750 vom 2025-04-01",
        "url": "https://www.ibm.com/support/pages/node/7229750"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:3467 vom 2025-04-01",
        "url": "https://access.redhat.com/errata/RHSA-2025:3467"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:3465 vom 2025-04-01",
        "url": "https://access.redhat.com/errata/RHSA-2025:3465"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:3540 vom 2025-04-02",
        "url": "https://access.redhat.com/errata/RHSA-2025:3540"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7229901 vom 2025-04-02",
        "url": "https://www.ibm.com/support/pages/node/7229901"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:3543 vom 2025-04-02",
        "url": "https://access.redhat.com/errata/RHSA-2025:3543"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7232032 vom 2025-04-29",
        "url": "https://www.ibm.com/support/pages/node/7232032"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4550 vom 2025-05-06",
        "url": "https://access.redhat.com/errata/RHSA-2025:4550"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4549 vom 2025-05-06",
        "url": "https://access.redhat.com/errata/RHSA-2025:4549"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4552 vom 2025-05-06",
        "url": "https://access.redhat.com/errata/RHSA-2025:4552"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:4548 vom 2025-05-06",
        "url": "https://access.redhat.com/errata/RHSA-2025:4548"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin",
        "url": "https://www.ibm.com/support/pages/node/7234827"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:8258 vom 2025-06-03",
        "url": "https://access.redhat.com/errata/RHSA-2025:8258"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:8761 vom 2025-06-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:8761"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7235497 vom 2025-06-21",
        "url": "https://www.ibm.com/support/pages/node/7235497"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7237155 vom 2025-06-26",
        "url": "https://www.ibm.com/support/pages/node/7237155"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:9922 vom 2025-06-30",
        "url": "https://access.redhat.com/errata/RHSA-2025:9922"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:12511 vom 2025-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2025:12511"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2025-127 vom 2025-09-30",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-127/index.html"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2025-126 vom 2025-09-30",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-126/index.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7248128 vom 2025-10-16",
        "url": "https://www.ibm.com/support/pages/node/7248128"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:23417 vom 2025-12-17",
        "url": "https://access.redhat.com/errata/RHSA-2025:23417"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat Enterprise Linux (Quarkus): Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-12-16T23:00:00.000+00:00",
      "generator": {
        "date": "2025-12-17T10:17:10.886+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-0460",
      "initial_release_date": "2025-02-27T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-02-27T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-03-03T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-03-11T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-03-18T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Atlassian aufgenommen"
        },
        {
          "date": "2025-03-27T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-03-31T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-04-01T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-04-02T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat und IBM aufgenommen"
        },
        {
          "date": "2025-04-28T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-05-06T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-05-27T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-06-02T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-06-09T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-06-22T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-06-26T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-06-30T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-08-03T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-09-29T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2025-10-16T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-12-16T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "20"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.2.2",
                "product": {
                  "name": "Atlassian Bamboo \u003c10.2.2",
                  "product_id": "T041966"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.2",
                "product": {
                  "name": "Atlassian Bamboo 10.2.2",
                  "product_id": "T041966-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:10.2.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.6.11",
                "product": {
                  "name": "Atlassian Bamboo \u003c9.6.11",
                  "product_id": "T041967"
                }
              },
              {
                "category": "product_version",
                "name": "9.6.11",
                "product": {
                  "name": "Atlassian Bamboo 9.6.11",
                  "product_id": "T041967-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:9.6.11"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Hitachi Ops Center",
            "product": {
              "name": "Hitachi Ops Center",
              "product_id": "T038840",
              "product_identification_helper": {
                "cpe": "cpe:/a:hitachi:ops_center:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM FlashSystem",
            "product": {
              "name": "IBM FlashSystem",
              "product_id": "T025159",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:flashsystem:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.7",
                "product": {
                  "name": "IBM InfoSphere Information Server 11.7",
                  "product_id": "444803",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:infosphere_information_server:11.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "InfoSphere Information Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.6.1",
                "product": {
                  "name": "IBM Maximo Asset Management 7.6.1",
                  "product_id": "389168",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:maximo_asset_management:7.6.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Maximo Asset Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV8.11.0.1 Interim fix 042",
                "product": {
                  "name": "IBM Operational Decision Manager \u003cV8.11.0.1 Interim fix 042",
                  "product_id": "T043174"
                }
              },
              {
                "category": "product_version",
                "name": "V8.11.0.1 Interim fix 042",
                "product": {
                  "name": "IBM Operational Decision Manager V8.11.0.1 Interim fix 042",
                  "product_id": "T043174-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:v8.11.0.1_interim_fix_042"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cV8.11.1.0: Interim fix 039",
                "product": {
                  "name": "IBM Operational Decision Manager \u003cV8.11.1.0: Interim fix 039",
                  "product_id": "T043175"
                }
              },
              {
                "category": "product_version",
                "name": "V8.11.1.0: Interim fix 039",
                "product": {
                  "name": "IBM Operational Decision Manager V8.11.1.0: Interim fix 039",
                  "product_id": "T043175-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:v8.11.1.0_interim_fix_039"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cV8.12.0.1: Interim fix 024",
                "product": {
                  "name": "IBM Operational Decision Manager \u003cV8.12.0.1: Interim fix 024",
                  "product_id": "T043176"
                }
              },
              {
                "category": "product_version",
                "name": "V8.12.0.1: Interim fix 024",
                "product": {
                  "name": "IBM Operational Decision Manager V8.12.0.1: Interim fix 024",
                  "product_id": "T043176-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:v8.12.0.1_interim_fix_024"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cV9.0.0.1: Interim fix 007",
                "product": {
                  "name": "IBM Operational Decision Manager \u003cV9.0.0.1: Interim fix 007",
                  "product_id": "T043177"
                }
              },
              {
                "category": "product_version",
                "name": "V9.0.0.1: Interim fix 007",
                "product": {
                  "name": "IBM Operational Decision Manager V9.0.0.1: Interim fix 007",
                  "product_id": "T043177-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:operational_decision_manager:v9.0.0.1_interim_fix_007"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Operational Decision Manager"
          },
          {
            "category": "product_name",
            "name": "IBM QRadar SIEM",
            "product": {
              "name": "IBM QRadar SIEM",
              "product_id": "T021415",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:qradar_siem:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM SAN Volume Controller",
            "product": {
              "name": "IBM SAN Volume Controller",
              "product_id": "T020642",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:san_volume_controller:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Analytic Server",
                "product": {
                  "name": "IBM SPSS Analytic Server",
                  "product_id": "T011789",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:analytic_server"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SPSS"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "12",
                "product": {
                  "name": "IBM Security Guardium 12",
                  "product_id": "T043916",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_guardium:sqlguard_12.0p35_bundle_jan-28-2025"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Guardium"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Quarkus \u003c3.8.6.SP3",
                "product": {
                  "name": "Red Hat Enterprise Linux Quarkus \u003c3.8.6.SP3",
                  "product_id": "T041477"
                }
              },
              {
                "category": "product_version",
                "name": "Quarkus 3.8.6.SP3",
                "product": {
                  "name": "Red Hat Enterprise Linux Quarkus 3.8.6.SP3",
                  "product_id": "T041477-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:quarkus__3.8.6.sp3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Quarkus \u003c3.15.3.SP1",
                "product": {
                  "name": "Red Hat Enterprise Linux Quarkus \u003c3.15.3.SP1",
                  "product_id": "T041478"
                }
              },
              {
                "category": "product_version",
                "name": "Quarkus 3.15.3.SP1",
                "product": {
                  "name": "Red Hat Enterprise Linux Quarkus 3.15.3.SP1",
                  "product_id": "T041478-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:quarkus__3.15.3.sp1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Quarkus \u003c3.20.1",
                "product": {
                  "name": "Red Hat Enterprise Linux Quarkus \u003c3.20.1",
                  "product_id": "T044254"
                }
              },
              {
                "category": "product_version",
                "name": "Quarkus 3.20.1",
                "product": {
                  "name": "Red Hat Enterprise Linux Quarkus 3.20.1",
                  "product_id": "T044254-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:quarkus__3.20.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Apache Camel 1",
                "product": {
                  "name": "Red Hat Enterprise Linux Apache Camel 1",
                  "product_id": "T044468",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:apache_camel_1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "category": "product_name",
            "name": "Red Hat Integration",
            "product": {
              "name": "Red Hat Integration",
              "product_id": "T033960",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:integration:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c8.5.3",
                "product": {
                  "name": "Red Hat JBoss Data Grid \u003c8.5.3",
                  "product_id": "T041746"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.3",
                "product": {
                  "name": "Red Hat JBoss Data Grid 8.5.3",
                  "product_id": "T041746-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_grid:8.5.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Data Grid"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.4.21",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform \u003c7.4.21",
                  "product_id": "T042265"
                }
              },
              {
                "category": "product_version",
                "name": "7.4.21",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 7.4.21",
                  "product_id": "T042265-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4.21"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-1247",
      "product_status": {
        "known_affected": [
          "T011789",
          "67646",
          "T041967",
          "T041746",
          "T041966",
          "389168",
          "T043916",
          "T033960",
          "T038840",
          "T020642",
          "T044468",
          "444803",
          "T021415",
          "T025159",
          "T041478",
          "T043174",
          "T041477",
          "T043175",
          "T044254",
          "T043176",
          "T043177",
          "T042265"
        ]
      },
      "release_date": "2025-02-27T23:00:00.000+00:00",
      "title": "CVE-2025-1247"
    },
    {
      "cve": "CVE-2025-1634",
      "product_status": {
        "known_affected": [
          "T011789",
          "67646",
          "T041967",
          "T041746",
          "T041966",
          "389168",
          "T043916",
          "T033960",
          "T038840",
          "T020642",
          "T044468",
          "444803",
          "T021415",
          "T025159",
          "T041478",
          "T043174",
          "T041477",
          "T043175",
          "T044254",
          "T043176",
          "T043177",
          "T042265"
        ]
      },
      "release_date": "2025-02-27T23:00:00.000+00:00",
      "title": "CVE-2025-1634"
    },
    {
      "cve": "CVE-2025-24970",
      "product_status": {
        "known_affected": [
          "T011789",
          "67646",
          "T041967",
          "T041746",
          "T041966",
          "389168",
          "T043916",
          "T033960",
          "T038840",
          "T020642",
          "T044468",
          "444803",
          "T021415",
          "T025159",
          "T041478",
          "T043174",
          "T041477",
          "T043175",
          "T044254",
          "T043176",
          "T043177",
          "T042265"
        ]
      },
      "release_date": "2025-02-27T23:00:00.000+00:00",
      "title": "CVE-2025-24970"
    }
  ]
}