Skip to content
OpenAdvisories
High · 7.5 CVE-2026-87743 EUVD-2026-82862GHSA-pw2v-hfg7-72m6

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Published Sep 18, 2026 · Updated Oct 29, 2026 · Assigned by redhat

Vendor: Red Hat Product: Exploit Intelligence Product: OpenShift Serverless Product: Red Hat build of Apache Camel 4 for Quarkus 3 Product: Red Hat build of Apicurio Registry 3 Product: Red Hat build of Debezium 3 Product: Red Hat Build of Keycloak Product: Red Hat build of Quarkus 3.27.5.SP2 Product: Red Hat build of Quarkus 3.33.3.SP2 Product: Red Hat Fuse 7 Product: Red Hat OpenShift AI (RHOAI) Product: Red Hat OpenShift Dev Spaces 3.31

Description

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Quarkus 3.27.5.SP2 — —
Red Hat Red Hat build of Quarkus 3.33.3.SP2 — —
Red Hat Red Hat OpenShift Dev Spaces 3.31 — —
Red Hat Exploit Intelligence — —
Red Hat OpenShift Serverless — —
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 — —
Red Hat Red Hat build of Apicurio Registry 3 — —
Red Hat Red Hat build of Debezium 3 — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Fuse 7 — —
Red Hat Red Hat OpenShift AI (RHOAI) — —

References