IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Red Hat Red Hat build of Quarkus 3.27.5.SP2; Red Hat Red Hat build of Quarkus 3.33.3.SP2; Red Hat Red Hat OpenShift Dev Spaces 3.31; Red Hat Exploit Intelligence Published: (1 month ago)

Description

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Weakness (CWE): CWE-551

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
openshift devspaces 3.31 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Exploit Intelligence —
Red Hat OpenShift Serverless —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 —
Red Hat Red Hat build of Apicurio Registry 3 —
Red Hat Red Hat build of Debezium 3 —
Red Hat Red Hat Build of Keycloak —
Red Hat Red Hat build of Quarkus 3.27.5.SP2 —
Red Hat Red Hat build of Quarkus 3.33.3.SP2 —
Red Hat Red Hat Fuse 7 —
Red Hat Red Hat OpenShift AI (RHOAI) —
Red Hat Red Hat OpenShift Dev Spaces 3.31 all versions

References and patches