quarkusio/quarkus · Security
Quarkus does not terminate HTTP requests header context
- GHSA ID
- GHSA-mwhw-6p27-4crc
- CVE ID
- CVE-2022-2466
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.
CWEs
- CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')