Quarkus does not terminate HTTP requests header context

2022-09-0100:00:23

Google

osv.dev

quarkus

http

header context

fix

version 2.10.4final

java applications

cloud native framework

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

57.2%

JSON

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.

CPENameOperatorVersion
io.quarkus:quarkus-core-parenteq2.10.0.Final
io.quarkus:quarkus-core-parenteq2.10.1.Final
io.quarkus:quarkus-core-parenteq2.10.2.Final
io.quarkus:quarkus-core-parenteq2.10.3.Final

Name	Operator	Version
io.quarkus:quarkus-core-parent	eq	2.10.0.Final
io.quarkus:quarkus-core-parent	eq	2.10.1.Final
io.quarkus:quarkus-core-parent	eq	2.10.2.Final
io.quarkus:quarkus-core-parent	eq	2.10.3.Final