GHSA-cxrx-q234-m22m

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

At a glance

Published: 2024-12-12 09:31 UTC
Updated: 2026-09-10 03:50 UTC
CVE: CVE-2024-12397
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Affected packages

Package	Versions
Maven · io.quarkus.http:quarkus-http-core	introduced 0, fixed 5.3.4

References

https://nvd.nist.gov/vuln/detail/CVE-2024-12397 ADVISORY
https://github.com/quarkusio/quarkus-http/pull/170 WEB
https://github.com/quarkusio/quarkus-http/commit/cfc99d80fce2e3a3dbf06972e648e79e925a7ae7 WEB
https://access.redhat.com/errata/RHSA-2025:0900 WEB
https://access.redhat.com/errata/RHSA-2025:1082 WEB
https://access.redhat.com/errata/RHSA-2025:3018 WEB
https://access.redhat.com/errata/RHSA-2025:8761 WEB
https://access.redhat.com/security/cve/CVE-2024-12397 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2331298 WEB
https://github.com/quarkusio/quarkus-http PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database