GHSA-mwhw-6p27-4crc

Quarkus does not terminate HTTP requests header context

At a glance

Published: 2022-09-01 00:00 UTC
Updated: 2023-11-08 04:08 UTC
CVE: CVE-2022-2466
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.

Affected packages

Package	Versions
Maven · io.quarkus:quarkus-core-parent	introduced 2.10.0, fixed 2.10.4

References

https://nvd.nist.gov/vuln/detail/CVE-2022-2466 ADVISORY
https://github.com/quarkusio/quarkus/issues/26748 WEB
https://github.com/quarkusio/quarkus PACKAGE
https://github.com/quarkusio/quarkus/releases/tag/2.10.4.Final WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database