GitHub Advisoryadvisory · Maven

GHSA-cxrx-q234-m22m io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

HIGH Published 2024-12-12 Modified 2025-06-10 Official page ↗
Aliases
CVE-2024-12397
Ecosystem
Maven
Packages
io.quarkus.http:quarkus-http-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-444
Reviewed
2024-12-12

Affected packages

• Maven io.quarkus.http:quarkus-http-core: < 5.3.4 → fixed in 5.3.4

Description

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Related

Alias · CVE (1)

  • CVE-2024-12397 A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References