7.4
High
CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
Description
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cryostat 4 on RHEL 9 4.0 | earliest → < 4.0.0-7 | 4.0.0-7 |
| HawtIO HawtIO 4.2.0 | Versions not published | |
| Red Hat build of Quarkus 3.15.3 | Versions not published | |
| Cryostat 3 | Versions not published | |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of OptaPlanner 8 | Versions not published | |
| Red Hat Fuse 7 | Versions not published |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Integration Camel K 1 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| streams for Apache Kafka | Versions not published | |
| Red Hat build of Keycloak 26.2 26.2 | earliest → < 26.2-3 | 26.2-3 |
References
- RHBA-2025:7525 access.redhat.com
- RHBA-2025:7639 access.redhat.com
- RHSA-2025:0900 access.redhat.com
- RHSA-2025:3018 access.redhat.com
- RHSA-2025:8761 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2331298 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Cryostat 4 on RHEL 9
The 54 CVEs of Cryostat 4 on RHEL 9 →
CVE-2026-54513
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor
8.1
High
CVE-2026-50559
Quarkus is a Java framework for building cloud-native applications
7.5
High
CVE-2026-9697
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or…
7.4
High
CVE-2026-6734
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying…
7.5
High