IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.5Hoch

CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Red Hat OpenShift Dev Spaces 3.31; Red Hat Exploit Intelligence Veröffentlicht: (vor 1 Monat)

Beschreibung

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Schwachstellentyp (CWE): CWE-551

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
openshift devspaces 3.31 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Exploit Intelligence —
Red Hat OpenShift Serverless —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 —
Red Hat Red Hat build of Apicurio Registry 3 —
Red Hat Red Hat build of Debezium 3 —
Red Hat Red Hat Build of Keycloak —
Red Hat Red Hat build of Quarkus 3.27.5.SP2 —
Red Hat Red Hat build of Quarkus 3.33.3.SP2 —
Red Hat Red Hat Fuse 7 —
Red Hat Red Hat OpenShift AI (RHOAI) —
Red Hat Red Hat OpenShift Dev Spaces 3.31 all versions

Referenzen und Patches