CVE-2022-2466

CRITICAL

Quarkus < 2.10.4 - HTTP Request Smuggling

Title source: rule

Description

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.

Exploits (1)

nomisec WORKING POC 1 stars
by yuxblank · poc
https://github.com/yuxblank/CVE-2022-2466---Request-Context-not-terminated-with-GraphQL

References (1)

Scores

CVSS v3 9.8
EPSS 0.1278
EPSS Percentile 94.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-444
Status published
Products (2)
io.quarkus/quarkus-core-parent 2.10.0 - 2.10.4Maven
quarkus/quarkus 2.10.0 - 2.10.4
Published Aug 31, 2022
Tracked Since Feb 18, 2026