CVE-2022-2466 Quarkus does not terminate HTTP requests header context
Quarkus fails to terminate HTTP request header context, potentially causing unpredictable behavior in the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2466?
CVE-2022-2466 is a critical vulnerability in quarkus, published on 31 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
Weakness: CWE-444
Which versions are affected by CVE-2022-2466?
2 open source packages ship an affected version, including io.quarkus:quarkus-core-parent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.quarkus:quarkus-core-parent Maven | From 2.10.0 | 2.10.4 |
io.quarkus:quarkus-core-parent Maven | From 2.10.0 | 2.10.4 |
Products include Quarkus Quarkus.
How do I fix CVE-2022-2466?
Upgrade io.quarkus:quarkus-core-parent to 2.10.4 or later.
Is CVE-2022-2466 being exploited?
There is no known exploitation of CVE-2022-2466 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in quarkus
- CVE-2022-4116 Code injection in quarkus dev ui config editor
- CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass
- CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency
- CVE-2022-0981 Privilege escalation in quarkus
- CVE-2023-6267 Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.
Sources
Also known as GHSA-mwhw-6p27-4crc.