CVE-2024-12397

Published: Dec 12, 2024Modified: Jun 17, 2026Deferred

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Related CWEs

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (5)

https://access.redhat.com/errata/RHSA-2025:0900

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:3018

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:8761

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2024-12397

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2331298

Source: secalert@redhat.com

Timeline

No history available yet.