Description
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Published: 2026-09-18
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
Title quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
First Time appeared Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
CPEs cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:debezium:3
cpe:/a:redhat:exploit_intelligence:0
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:openshift_ai
cpe:/a:redhat:openshift_devspaces:3
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:serverless:1
Vendors & Products Redhat
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat debezium
Redhat exploit Intelligence
Redhat jboss Fuse
Redhat openshift Ai
Redhat openshift Devspaces
Redhat quarkus
Redhat serverless
References

Fri, 18 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Title quarkus-vertx-http: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security
Weaknesses CWE-551
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Important

Subscriptions

Redhat Apicurio Registry Build Keycloak Camel Quarkus Debezium Exploit Intelligence Jboss Fuse Openshift Ai Openshift Devspaces Quarkus Serverless
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-18T09:38:27.326Z

Reserved: 2026-09-09T05:58:00.263Z

Link: CVE-2026-87743

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-18T10:17:07.520

Modified: 2026-09-18T10:17:07.520

Link: CVE-2026-87743

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-17T13:10:22Z

Links: CVE-2026-87743 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-551

    Incorrect Behavior Order: Authorization Before Parsing and Canonicalization