GitHub Advisoryadvisory · Maven

GHSA-mwhw-6p27-4crc Quarkus does not terminate HTTP requests header context

CRITICAL Published 2022-09-01 Modified 2022-09-16 Official page ↗
Aliases
CVE-2022-2466
Ecosystem
Maven
Packages
io.quarkus:quarkus-core-parent
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-444
Reviewed
2022-09-16

Affected packages

• Maven io.quarkus:quarkus-core-parent: >= 2.10.0, < 2.10.4 → fixed in 2.10.4

Description

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.

Related

Alias · CVE (1)

  • CVE-2022-2466 It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References