{"id":"RHLW-2026-f6f1fa9b81c3bbbe","summary":"Lightwell Security Advisory: quarkus-http-core 4.1.8.rhlw-00005","details":"Red Hat Lightwell has released io.quarkus.http:quarkus-http-core 4.1.8.rhlw-00005 with backported fixes for CVE-2024-12397 and CVE-2024-3653.\n\nCVE-2024-12397: Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling\n\nCVE-2024-3653: Undertow: learningpushhandler can lead to remote memory dos attacks\n\nThis patched artifact is a drop-in replacement for io.quarkus.http:quarkus-http-core 4.1.8 from Maven Central.","modified":"2026-10-22T00:08:28.958795199Z","published":"2026-09-28T20:37:17Z","upstream":["CVE-2024-12397","CVE-2024-3653","GHSA-ch7q-gpff-h9hp","GHSA-cxrx-q234-m22m"],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:0900"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:3018"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:8761"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-12397"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12397.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12397"},{"type":"PACKAGE","url":"https://github.com/quarkusio/quarkus-http"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cxrx-q234-m22m"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:4392"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:5143"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:5144"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:5145"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:5147"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:6437"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-3653"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3653.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3653"},{"type":"PACKAGE","url":"https://github.com/undertow-io/undertow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-ch7q-gpff-h9hp"}],"affected":[{"package":{"name":"io.quarkus.http:quarkus-http-core","ecosystem":"Red Hat Lightwell:Maven","purl":"pkg:maven/io.quarkus.http/quarkus-http-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8.rhlw-00005"}]}],"versions":["3.0.0.Alpha1","3.0.0.Alpha2","3.0.0.Alpha3","3.0.0.Alpha4","3.0.0.Alpha5","3.0.0.Alpha6","3.0.0.Alpha7","3.0.0.Beta1","3.0.0.Beta2","3.0.0.Beta3","3.0.0.Final","3.0.1.Final","3.0.10.Final","3.0.11.Final","3.0.12.Final","3.0.13.Final","3.0.14.Final","3.0.15.Final","3.0.16.Final","3.0.17.Final","3.0.18.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.0.5.Final","3.0.6.Final","3.0.7.Final","3.0.8.Final","3.0.9.Final","3.1.0.Beta1","3.1.0.Beta2","3.1.0.Final","3.1.1.Final","4.0.0","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8"],"database_specific":{"lightwell":{"remediated_version":"4.1.8.rhlw-00005","repository_url":"https://packages.redhat.com/lightwell/java/remediated/","backport_base_version":"4.1.8"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f6f1fa9b81c3bbbe.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}