{"id":"CVE-2024-12397","title":"A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests","summary":"A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests. This issue could\nallow an attacker to construct a cookie value to exfiltrate HttpOnly cookie\nvalues or spoo…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-444"],"published":"2024-12-12","updated":"2026-08-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-12397","references":[{"url":"https://access.redhat.com/errata/RHSA-2025:0900","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:3018","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2025:8761","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2024-12397","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331298","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12397.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12397"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12397"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00843,"epssPercentile":0.57754,"ingestedAt":"2026-08-04T07:38:00.139Z","vendor":"Red Hat","product":"Cryostat 4 on RHEL 9","affected":["cryostat 3","build_of_apache_camel_4_for_quarkus 3","build_of_apicurio_registry 2","build_of_keycloak","build_of_optaplanner 8","fuse 7","integration_camel_k 1","process_automation 7","streams_for_apache_kafka","cryostat_4_on_rhel 9","hawtio_hawtio 4.2.0","build_of_quarkus 3.15.3"],"patched":["cryostat_4_on_rhel 9","hawtio_hawtio 4.2.0","build_of_quarkus 3.15.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-12-12T15:31:47.316503Z"},"slug":"CVE-2024-12397","body":"## Overview\n\nA flaw was found in Quarkus-HTTP, which incorrectly parses cookies with\ncertain value-delimiting characters in incoming requests. This issue could\nallow an attacker to construct a cookie value to exfiltrate HttpOnly cookie\nvalues or spoof arbitrary additional cookie values, leading to unauthorized\ndata access or modification. The main threat from this flaw impacts data\nconfidentiality and integrity.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:3018** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2025-03-19 · [advisory](https://access.redhat.com/errata/RHSA-2025:3018)\n- **RHSA-2025:8761** · Red Hat · fixed in: HawtIO HawtIO 4.2.0 · released 2025-06-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:8761)\n- **RHSA-2025:0900** · Red Hat · fixed in: Red Hat build of Quarkus 3.15.3 · released 2025-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2025:0900)\n- **Red Hat VEX** · Moderate · affected: Cryostat 3, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, … · no fix planned: Red Hat Fuse 7, Red Hat build of OptaPlanner 8, Red Hat build of Apicurio Registry 2, Red Hat Build of Keycloak, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12397.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}