CVE-2022-4147

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-06 · updated 2026-06-17
Weakness: CWE-1026

Description

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Affected products

quarkusio quarkus: from 2.0 before 2.13.5; from 2.14.0 before 2.14.2 — fixed in 2.13.5, 2.14.2

How to fix

Upgrade to a fixed version: quarkusio quarkus 2.13.5, 2.14.2. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2022-4147
https://access.redhat.com/security/cve/CVE-2022-4147

Get alerted when CVE-2022-4147 or the next vulnerability affects your stack