What is GHSA-mwhw-6p27-4crc?

GHSA-mwhw-6p27-4crc is a security advisory published by GitHub Security Advisories with Critical severity. Quarkus does not terminate HTTP requests header context

Which CVE IDs does GHSA-mwhw-6p27-4crc cover?

GHSA-mwhw-6p27-4crc covers the following CVE IDs: CVE-2022-2466. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mwhw-6p27-4crc?

GHSA-mwhw-6p27-4crc has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mwhw-6p27-4crc?

GHSA-mwhw-6p27-4crc affects 1 product, including: maven/io.quarkus:quarkus-core-parent:\u003e= 2.10.0, \u003c 2.10.4.

GHSA-mwhw-6p27-4crcCriticalCVSS 9.8

Quarkus does not terminate HTTP requests header context

Vendor

GitHub Security Advisories

Published

September 1, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-2466 →

📋 Description

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.

🎯 Affected products1

maven/io.quarkus:quarkus-core-parent:>= 2.10.0, < 2.10.4

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-2466
https://github.com/quarkusio/quarkus/issues/26748
https://github.com/quarkusio/quarkus/releases/tag/2.10.4.Final
https://github.com/advisories/GHSA-mwhw-6p27-4crc