CVE-2022-2466CWE-444

It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior

published August 31, 2022

CVSS
—
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

⚠️ Quarkus 2.10.x could be a bit unpredictable, like a waiter who keeps forgetting to clear old orders off the table! Picture a restaurant where the waitstaff forget to clean up after each course. As a result, dishes pile up, leading to confusion over what’s served next. That’s how this vulnerability behaves with HTTP requests – old headers linger, creating uncertainty in responses. The lingering headers might cause unexpected behavior in your application, like serving stale data or even causing the app to misbehave entirely. While it may not be an immediate disaster, it can lead to frustrating user experiences and potential application instability.

Put simply

Picture a restaurant where the waitstaff forget to clean up after each course. As a result, dishes pile up, leading to confusion over what’s served next. That’s how this vulnerability behaves with HTTP requests – old headers linger, creating uncertainty in responses. This vulnerability arises because Quarkus 2.10.x fails to properly terminate the context of HTTP request headers, which can allow for unpredictable results when handling requests.

What to do

The lingering headers might cause unexpected behavior in your application, like serving stale data or even causing the app to misbehave entirely. While it may not be an immediate disaster, it can lead to frustrating user experiences and potential application instability. To address this, ensure you update to the latest version of Quarkus. Check release notes for any specific changes regarding HTTP request handling and monitor your application's behavior post-update. You've got this! With a quick update, you can keep your application running smoothly. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01870 · 79.2th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2022-08-31T15:33Z
EPSS history
Timeline
  • 31 AUG 15:33Z
    It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior
    cvelistv5