RHLW-2026-F6F1FA9B81C3BBBE Lightwell Security Advisory: quarkus-http-core 4.1.8.rhlw-00005

Red Hat Lightwell has released io.quarkus.http:quarkus-http-core 4.1.8.rhlw-00005 with backported fixes for CVE-2024-12397 and CVE-2024-3653. CVE-2024-12397: Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling CVE-2024-3653: Undertow: learningpushhandler can lead to remote memory dos...

Security Bulletin: IBM Maximo Application Suite uses httpcore5-5.3.4.jar which is vulnerable to CVE-2026-54399

Summary IBM Maximo Application Suite uses httpcore5-5.3.4.jar which is vulnerable to CVE-2026-54399. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-54399 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in the...

EUVD-2021-0909

Malware in sbrugna...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha1), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha1) +2 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha1)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha1 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha2), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha2) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha2)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha2 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha3), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha3) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha3)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha3 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha3 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha4), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha4) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha4)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha4 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha4 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha5), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha5) +40 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha5)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha5 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha5 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha6), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha6) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha6)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha6 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha6 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.alpha7), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.alpha7) +50 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.alpha7)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.alpha7 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.alpha7 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=0.26.0, <=1.2.1.final), io.quarkus.http:quarkus-http-servlet (3.0.0.beta1) +25 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.beta1)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =0.26.0, =0.26.0, =0.26.0, =0.24.0,...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (0.25.0), io.apicurio:apicurio-registry-app (1.0.2.final) +37 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.beta2)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin 0.25.0 - io.apicurio:apicurio-registry-a...

io.quarkus.http:quarkus-http-servlet (3.0.0.beta3), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.beta3) +32 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.beta3)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.beta3 -...

io.quarkus.http:quarkus-http-servlet (3.0.0.final), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.final) +28 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.final -...

com.github.ideahut:qms-shared (1.0.0), com.github.ideahut:qms-shared-core (1.0.0) +39 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.1.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.github.ideahut:qms-shared 1.0.0 - com.github.ideahut:qms-shared-core 1.0.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.3.0.alpha1, <=1.3.0.alpha2), io.apicurio:apicurio-registry-app (1.1.2.final) +40 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.2.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =1.3.0.alpha1, =1.3.0.alpha1,...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.3.0.cr1, <=1.3.0.final), io.quarkus.http:quarkus-http-servlet (3.0.3.final) +38 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.3.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =1.3.0.cr1, =1.3.0.cr1, =1.3.0.cr1,...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.3.1.final, <=1.4.0.cr1), io.quarkus.http:quarkus-http-servlet (3.0.4.final) +37 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.4.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =1.3.1.final, =1.3.1.final, =1.3.1.final...

io.quarkus.http:quarkus-http-servlet (3.0.5.final), io.quarkus.http:quarkus-http-websockets-jsr (3.0.5.final) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.5.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.5.final -...

com.alibaba.csp:sentinel-jax-rs-quarkus-adapter-deployment (>=1.8.0, <=1.8.10), com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha2) +38 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.6.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.alibaba.csp:sentinel-jax-rs-quarkus-adapter-deployment =1.8.0, =1.4.0.final,...