It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HQuarkus
APPQuarkus2.10.0 – 2.10.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-12225CRITICAL9.1PL ✓same product
Quarkus WebAuthn: pominięcie uwierzytelnienia przez domyślne endpointy REST
CVE-2022-4116CRITICAL9.8PL ✓same product
RCE w Quarkus Dev UI Config Editor poprzez drive-by localhost attack
CVE-2021-26291CRITICAL9.1PL ✓same product
Apache Maven: podążanie za niezaufanymi repozytoriami HTTP (MitM)
CVE-2026-50559HIGH7.5same product
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1...
CVE-2026-39852HIGH8.8same product
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3...