Read the docs
TI-2024-30678 Aliases CVE-2024-45687GHSA-mqh5-c2wx-v3pq

HTTP Server incorrectly accepting disallowed characters within header values

Priority LOW 12CWE-113Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Payara PlatformPayara Server4.1.151 – 4.1.2.191.51; 5.20.0 – 5.70.0; 5.2020.2 – 5.2022.5; 6.2022.1 – 6.2024.12; 6.0.0 – 6.21.0—No fix listedCNA
Payara PlatformPayara Micro4.1.152 – 4.1.2.191.51; 5.20.0 – 5.70.0; 5.2020.2 – 5.2022.5; 6.2022.1 – 6.2024.12; 6.0.0 – 6.21.0—No fix listedCNA
  • Payara Server VendorPayara Platform Affected 4.1.151 – 4.1.2.191.51; 5.20.0 – 5.70.0; 5.2020.2 – 5.2022.5; 6.2022.1 – 6.2024.12; 6.0.0 – 6.21.0 Fixed in — No fix listed CNA
  • Payara Micro VendorPayara Platform Affected 4.1.152 – 4.1.2.191.51; 5.20.0 – 5.70.0; 5.2020.2 – 5.2022.5; 6.2022.1 – 6.2024.12; 6.0.0 – 6.21.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:payara:payara:*:*:*:*:*:*:*:*——Payara Platform

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45687
  2. 2026-10-03 Alias added: GHSA-mqh5-c2wx-v3pq

References

Other 3

  • TI-2022-22205 Payara before 2022-11-04, when deployed to the root context, allows attackers to visit… CVSS 3.1HIGH 7.5
  • TI-2021-18200 Payara Micro Community 5.2021.6 and below allows Directory Traversal. CVSS 3.1HIGH 7.5
  • TI-2023-13003 A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191… CVSS 3.1CRITICAL 9.8
  • TI-2024-07614 Payload Injection Attack via Management REST interface CVSS 4.0HIGH 8.7
  • TI-2025-13101 Admin Account Takeover via malicious URL payload CVSS 4.0HIGH 7.3
  • TI-2022-17489 Payara through 5.2022.2 allows directory traversal without authentication. CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences