What is the CVSS score of EUVD-2025-18925?

EUVD-2025-18925 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by EUVD-2025-18925?

Organizations using versions should be aware of moderate risk from CVE-2025-49574 rated CVSS 6.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2025-18925?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Java EUVD-2025-18925

| CVE-2025-49574 MEDIUM

Exposure of Resource to Wrong Sphere (CWE-668)

2025-06-23 security-advisories@github.com

GHSA-9623-mj7j-p9v4

Information Disclosure Java Red Hat

6.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Red Hat

6.4 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18925

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

CVE Published

Jun 23, 2025 - 20:15 nvd

MEDIUM 6.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

305 maven packages depend on io.quarkus:quarkus-vertx (40 direct, 265 indirect)

Ecosystem-wide dependent count for version 3.16.0.CR1.

DescriptionGitHub Advisory

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.1, 3.20.2, and 3.15.6.