CVE-2022-4147

7.5 highEPSS 0.6%

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-1026
Published: 2022-12-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

quarkus:quarkus

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9895-g6x5-xwcp	Maven	io.quarkus:quarkus-vertx-http	>=2.14.0.CR1 <2.14.2.Final	2.14.2.Final
GHSA-9895-g6x5-xwcp	Maven	io.quarkus:quarkus-vertx-http	<2.13.5.Final	2.13.5.Final

References

https://access.redhat.com/security/cve/CVE-2022-4147
https://access.redhat.com/security/cve/CVE-2022-4147

Check your stack JSON