CVE-2024-12397: Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-12 · updated 2026-10-30
Weakness: CWE-444

Description

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

Affected products

quarkus-http: before 5.3.4 — fixed in 5.3.4
Red Hat build of Keycloak 26.4: all versions — fixed in 26.2.4-2
Red Hat Cryostat 3: all versions
Red Hat Cryostat 4 on RHEL 9: all versions — fixed in 0.5.0-6
Red Hat build of Apache Camel 4 for Quarkus 3: all versions
Red Hat build of Apicurio Registry 2: all versions
Red Hat build of OptaPlanner 8: all versions
Red Hat Integration Camel K 1: all versions
Red Hat Process Automation 7: all versions
Red Hat streams for Apache Kafka: all versions

How to fix

Upgrade to a fixed version: quarkus-http 5.3.4; Red Hat build of Keycloak 26.4 26.2.4-2; Red Hat Cryostat 4 on RHEL 9 0.5.0-6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-12397 or the next vulnerability affects your stack