Skip to content
Sign in
7.5 High

CVE-2026-87743 A flaw was found in Quarkus HTTP security

Description

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Affected products and versions

Product Affected versions Fixed in
Exploit Intelligence Versions not published
OpenShift Serverless Versions not published
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Build of Keycloak Versions not published
Red Hat build of Quarkus Versions not published
Red Hat Fuse 7 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Show the 4 other branches
Product Affected versions Fixed in
Red Hat OpenShift Dev Spaces Versions not published
Red Hat build of Quarkus 3.27.5.SP2 Versions not published
Red Hat build of Quarkus 3.33.3.SP2 Versions not published
Red Hat OpenShift Dev Spaces 3.31 1792491532 earliest → < 1792491532 1792491532

Other CVEs of Exploit Intelligence

The 29 CVEs of Exploit Intelligence →
CVE-2026-121837 Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort 4.3 Medium CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 3.3 Low CVE-2026-87744 A flaw was found in Quarkus REST Data Panache 9.1 Critical
Track this CVE