CVE-2024-12397
Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Record
CVE-2024-12397- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-05
EUVDEUVD-2024-3462
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Record
EUVD-2024-3462- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-cxrx-q234-m22m
io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Record
GHSA-cxrx-q234-m22m- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
NVD
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Record
CVE-2024-12397- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-05
OSV
Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Record
CVE-2024-12397- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-07
OSVGHSA-cxrx-q234-m22m
io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
- Record
GHSA-cxrx-q234-m22m- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVRHLW-2026-f6f1fa9b81c3bbbe
Lightwell Security Advisory: quarkus-http-core 4.1.8.rhlw-00005
Red Hat Lightwell has released io.quarkus.http:quarkus-http-core 4.1.8.rhlw-00005 with backported fixes for CVE-2024-12397 and CVE-2024-3653.
CVE-2024-12397: Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
CVE-2024-3653: Undertow: learningpushhandler can lead to remote memory dos attacks
This patched artifact is a drop-in replacement for io.quarkus.http:quarkus-http-core 4.1.8 from Maven Central.
- Record
RHLW-2026-f6f1fa9b81c3bbbe- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
- red hat cryostat 3
- red hat cryostat 4 on rhel 9
- red hat hawtio hawtio 4.2.0
- red hat build of apache camel 4 for quarkus 3
- red hat build of apicurio registry 2
- red hat build of keycloak
- red hat build of keycloak 26.2
- red hat build of optaplanner 8
- red hat build of quarkus 3.15.3
- red hat fuse 7
- red hat integration camel k 1
- red hat jboss enterprise application platform 8
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus.http:quarkus-http-coreMaven |
before 5.3.4 | 5.3.4 |
io.quarkus.http:quarkus-http-coreMaven |
before 5.3.4, plus listed versions 3.0.0.Alpha13.0.0.Alpha23.0.0.Alpha33.0.0.Alpha43.0.0.Alpha5 Show 45 moreShow less3.0.0.Alpha63.0.0.Alpha73.0.0.Beta13.0.0.Beta23.0.0.Beta33.0.0.Final3.0.1.Final3.0.10.Final3.0.11.Final3.0.12.Final3.0.13.Final3.0.14.Final3.0.15.Final3.0.16.Final3.0.17.Final3.0.18.Final3.0.2.Final3.0.3.Final3.0.4.Final3.0.5.Final3.0.6.Final3.0.7.Final3.0.8.Final3.0.9.Final3.1.0.Beta13.1.0.Beta23.1.0.Final3.1.1.Final4.0.04.0.0.Alpha24.0.0.Alpha34.0.0.Alpha44.1.14.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.15.0.0.Alpha15.0.0.Alpha25.0.0.Alpha3 |
5.3.4 |
io.quarkus.http:quarkus-http-coreRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 4.1.8.rhlw-00005, plus listed versions 3.0.0.Alpha13.0.0.Alpha23.0.0.Alpha33.0.0.Alpha43.0.0.Alpha5 Show 40 moreShow less3.0.0.Alpha63.0.0.Alpha73.0.0.Beta13.0.0.Beta23.0.0.Beta33.0.0.Final3.0.1.Final3.0.10.Final3.0.11.Final3.0.12.Final3.0.13.Final3.0.14.Final3.0.15.Final3.0.16.Final3.0.17.Final3.0.18.Final3.0.2.Final3.0.3.Final3.0.4.Final3.0.5.Final3.0.6.Final3.0.7.Final3.0.8.Final3.0.9.Final3.1.0.Beta13.1.0.Beta23.1.0.Final3.1.1.Final4.0.04.0.0.Alpha24.0.0.Alpha34.0.0.Alpha44.1.14.1.24.1.34.1.44.1.54.1.64.1.74.1.8 |
4.1.8.rhlw-00005 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-12397 is a high vulnerability (CVSS 7.4) in Red Hat Cryostat 3, published December 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in io.quarkus.http:quarkus-http-core 5.3.4.
References
access.redhat.com/errata/RHBA-2025:7525
Show 22 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2331298
nvd.nist.gov/vuln/detail/CVE-2024-12397
github.com/quarkusio/quarkus-http/pull/170
catalog.redhat.com/software/containers
Left out here: 14 versions. The JSON record has them.