HTTP Request Smuggling Affecting io.quarkus.http:quarkus-http-core package, versions [,5.3.4)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IOQUARKUSHTTP-8499647
- published12 Dec 2024
- disclosed12 Dec 2024
- creditUnknown
Introduced: 12 Dec 2024
NewCVE-2024-12397 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade io.quarkus.http:quarkus-http-core to version 5.3.4 or higher.
Overview
Affected versions of this package are vulnerable to HTTP Request Smuggling due to the incorrect parsing of cookies with certain value-delimiting characters in incoming requests. An attacker can exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification.