CVE-2023-4853
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Risk Assessment
Bypassing security policies could lead to unauthorized access to sensitive resources and disruption of services.
Recommendation
It is recommended to update Quarkus to a patched version and review security policy configurations.
Other vulnerabilities in Quarkus
See all- CVE-2026-50559High
A vulnerability in Quarkus allows bypassing HTTP path-based authorization policies using encoded semicolons (%3B) and slashes (%2F or %5C).
- CVE-2026-39852High
Quarkus before versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 has a path normalization inconsistency between the security layer and routing. An attacker can bypass authorization policies by appending a semicolon and arbitrary text to the URL (e.g., /api/admin;anything).
- CVE-2024-1726Medium
A flaw in the RESTEasy Reactive implementation in Quarkus causes security checks for some JAX-RS endpoints to be performed after serialization, consuming more processing resources during HTTP request checks. In certain configurations, an attacker knowing POST, PUT, or PATCH request paths can potentially overload vulnerable endpoints, leading to denial of service.
- CVE-2024-1979Low
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
Original NVD description (English source)
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.