{"id":"CVE-2022-2466","aliases":["EUVD-2022-6884","GHSA-mwhw-6p27-4crc"],"status":"published","title":"Quarkus does not terminate HTTP requests header context","description":"It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01911,"percentile":0.79953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-444"],"published":"2022-08-31T15:33:01Z","modified":"2026-10-28T02:30:43Z","exploits":[{"source":"pocgithub","id":"yuxblank/CVE-2022-2466---Request-Context-not-terminated-with-GraphQL","title":"yuxblank/CVE-2022-2466---Request-Context-not-terminated-with-GraphQL","date":"2022-07-26","url":"https://github.com/yuxblank/CVE-2022-2466---Request-Context-not-terminated-with-GraphQL"}],"fixes":[{"ecosystem":"Maven","package":"io.quarkus:quarkus-core-parent","fixed_in":["2.10.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-core-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-core-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.4"}]}],"versions":["2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final"]}],"products":[{"vendor":"quarkus","product":"quarkus"},{"vendor":"quarkusio","product":"quarkus"}],"references":[{"url":"https://github.com/quarkusio/quarkus/issues/26748","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2466","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus/releases/tag/2.10.4.Final","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mwhw-6p27-4crc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2466.json","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-2466","description":"It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.","status":"published","published":"2022-08-31T15:33:01Z","modified":"2024-08-03T00:39:07.746Z","cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-6884","description":"It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.","status":"published","published":"2022-08-31T15:33:01Z","modified":"2024-08-03T00:39:07Z","updated_at":"2026-11-03T03:25:57.932023Z"}],"ghsa":[{"id":"GHSA-mwhw-6p27-4crc","title":"Quarkus does not terminate HTTP requests header context","description":"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.","status":"published","published":"2022-09-01T00:00:23Z","modified":"2023-01-27T05:02:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2022-2466","description":"It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.","status":"published","published":"2022-08-31T16:15:10.943Z","modified":"2026-06-17T04:41:56.9Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"GHSA-mwhw-6p27-4crc","title":"Quarkus does not terminate HTTP requests header context","description":"Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.","status":"published","published":"2022-09-01T00:00:23Z","modified":"2023-11-08T04:08:32.348432Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"CVE-2022-2466","description":"It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.","status":"published","published":"2022-08-31T15:33:01Z","modified":"2026-10-28T02:30:43.194729951Z","cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:24.428403Z"}]}}