CVE-2022-2466: 
Java vulnerability analysis and mitigation

A vulnerability was identified in Quarkus versions 2.10.x where HTTP request header context is not properly terminated, leading to potential security issues. The vulnerability is tracked as CVE-2022-2466 and affects the request context handling in Quarkus applications (Quarkus Issue, CVE Mitre).

The vulnerability manifests when accessing RoutingContext request from a bean in Quarkus 2.10.x applications. The issue causes the headers of the first request to persist and be returned for all subsequent requests. This affects both @GraphQLAPI endpoints and any CDI bean that consumes RoutingContext or HttpServerRequest. The CurrentVertxRequest maintains stale headers, indicating a failure in proper request context termination (Quarkus Issue).

The vulnerability can lead to information leakage and security issues as subsequent requests may receive header information from previous requests, potentially exposing sensitive data such as authentication tokens or other security-related headers (Quarkus Issue).

Users are advised to upgrade from Quarkus 2.10.x to a patched version. As a temporary workaround, users can downgrade to Quarkus 2.9.x where this issue is not present (Quarkus Issue).