Lucene search
Veracode Vulnerability DatabaseVERACODE:36883HistorySep 01, 2022 - 8:03 a.m.
HTTP Request Smuggling
2022-09-0108:03:15
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
14
quarkus
http request smuggling
smallryegraphqlabstracthandler
0.002 Low
EPSS
Percentile
57.2%
Quarkus is vulnerable to HTTP request smuggling. The vulnerability exists in handle function in SmallRyeGraphQLAbstractHandler.java due to incomplete termination of the HTTP request header which allows an attacker to smuggle HTTP requests by submitting malicious headers.
References
github.com/advisories/GHSA-mwhw-6p27-4crc
github.com/quarkusio/quarkus/commit/48787dec704466fc9bd53cd2cb134d40c77dc880
github.com/quarkusio/quarkus/commit/f23ca08e47a9731401f1c4472da0e6fe2bc1c413
github.com/quarkusio/quarkus/issues/26748
github.com/quarkusio/quarkus/pull/26777
quarkus.io/blog/quarkus-2-11-3-final-released
Related
nvd
nvd
CVE-2022-2466
2022-08-31 16:15:10
osv
osv
Quarkus does not terminate HTTP requests header context
2022-09-01 00:00:23
CVE-2022-2466
2022-08-31 16:15:10
cve
cve
CVE-2022-2466
2022-08-31 16:15:10
cvelist
cvelist
CVE-2022-2466
2022-08-31 15:33:01
redhatcve
redhatcve
CVE-2022-2466
2022-07-19 02:16:29
github
github
Quarkus does not terminate HTTP requests header context
2022-09-01 00:00:23
githubexploit
githubexploit
Exploit for HTTP Request Smuggling in Quarkus
2022-07-26 09:45:46
prion
prion
Design/Logic Flaw
2022-08-31 16:15:00