CVE-2024-12397

highpriority · track · 0EPSS 0.008 · 57 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.83% (57th) EPSS

CVSS 7.4 · high

Is it mine?

48 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4

v3.17.4highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USexploitability 2.2 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-444USCWE-444USCWE-444US

affected products (48)

Products and version ranges known to be affected.

Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM InfoSphere Information Server 11.7all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7
IBM Operational Decision Manager <V8.11.0.1 Interim fix 042all versionscert_bundDE
IBM Operational Decision Manager <V8.11.1.0: Interim fix 039all versionscert_bundDE
IBM Operational Decision Manager <V8.12.0.1: Interim fix 024all versionscert_bundDE
IBM Operational Decision Manager <V9.0.0.1: Interim fix 007all versionscert_bundDE
IBM QRadar SIEMall versionscert_bundDEcpe:/a:ibm:qradar_siem:-
IBM SPSSall versionscert_bundDEcpe:/a:ibm:spss:modeler
IBM SPSS Analytic Serverall versionscert_bundDEcpe:/a:ibm:spss:analytic_server
IBM Security Guardium 12all versionscert_bundDEcpe:/a:ibm:security_guardium:sqlguard_12.0p35_bundle_jan-28-2025
IBM Sterling Connect:Direct <6.2.0.27all versionscert_bundDE
IBM Sterling Connect:Direct <6.3.0.12all versionscert_bundDE
IBM TXSeries for multiplatformsall versionscert_bundDEcpe:/a:ibm:txseries:for_multiplatforms
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Apache Camel 1all versionscert_bundDEcpe:/o:redhat:enterprise_linux:apache_camel_1
Red Hat Enterprise Linux Apache Camel 4.8 for Quarkus <3.15all versionscert_bundDE
Red Hat Enterprise Linux Cryostat 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:cryostat_4
Red Hat Enterprise Linux Quarkus <3.15.3all versionscert_bundDE
Red Hat JBoss A-MQ Streams 2all versionscert_bundDEcpe:/a:redhat:jboss_amq:streams_2

showing 20 of 48

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0285Red Hat Enterprise Linux (Quarkus und Netty): Mehrere SchwachstellenDeutsch2025-02-05csaf · cert_bundDE
Ein anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.
GHSA-cxrx-q234-m22mio.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling2024-12-12ghsa · osvUS
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2024-12-12modified 2026-10-20

references (14)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan