{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/quarkusio/quarkus-http","packageName":"quarkus-http","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"5.3.4","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-agent-init-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0.5.0-6","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-db-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-grafana-dashboard-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-openshift-console-plugin-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-operator-bundle","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-ose-oauth-proxy-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-reports-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-rhel9-operator","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/cryostat-storage-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"cryostat/jfr-datasource-rhel9","product":"Cryostat 4 on RHEL 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.0.0-7","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"HawtIO HawtIO 4.2.0","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","product":"Red Hat Build of Keycloak","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.2","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2.4-2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.2","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2-3","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.2","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.2-3","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"quarkus-http-core","product":"Red Hat build of Quarkus 3.15.3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Cryostat 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-camel-bom","product":"Red Hat build of Apache Camel 4 for Quarkus 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-cxf-bom","product":"Red Hat build of Apache Camel 4 for Quarkus 3","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Red Hat build of Apicurio Registry 2","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Red Hat Build of Keycloak","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Red Hat build of OptaPlanner 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Red Hat Fuse 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Red Hat Integration Camel K 1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"quarkus-http-core","product":"Red Hat JBoss Enterprise Application Platform 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"quarkus-http-core","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"Red Hat Process Automation 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quarkus-http-core","product":"streams for Apache Kafka","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2024-12397","cwes":["CWE-444"],"description":"A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests. This issue could\nallow an attacker to construct a cookie value to exfiltrate HttpOnly cookie\nvalues or spoof arbitrary additional cookie values, leading to unauthorized\ndata access or modification. The main threat from this flaw impacts data\nconfidentiality and integrity.","epss":{"date":"2026-11-04","percentile":0.60621,"score":0.00928},"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793879107365,"publishedAt":1733994328451,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHBA-2025:7525"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHBA-2025:7639"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:0900"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:3018"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:8761"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-12397"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331298"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Currently, no mitigation is available for this vulnerability."}],"revision":"5dbe64096dcd9a43b840feaed91c9ea495b0c1978fbf0cc61c890b0b35c08bcc","sources":[{"modifiedAt":1793879107365,"name":"CNA: redhat","retrievedAt":1793880741729,"url":"https://www.cve.org/CVERecord?id=CVE-2024-12397"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793857756187,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-12397"}],"ssvc":{"assessedAt":1734017507316,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling","updatedAt":1793880741729}