CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha2), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (1.5.0-alpha2) +226 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.4.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base 1.5.0-alpha2 -...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.5.0-alpha4, <=1.5.0-alpha5), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (>=1.5.0-alpha4, <=1.5.0-alpha5) +249 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.5.0-alpha4, =1.5.0-alpha4, =1.5.0-alpha...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.2), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.2) +124 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.2 -...

br.com.labbs:quarkus-monitor-reactive (1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (1.0.4) +235 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.labbs:quarkus-monitor-reactive 1.0.4 - br.com.labbs:quarkus-monitor-reactive-deployment...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.3.1), io.quarkiverse.cxf:quarkus-cxf (1.5.4) +127 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.3.1 -...

io.quarkiverse.cxf:quarkus-cxf (>=1.5.8, <=1.5.10), io.quarkiverse.cxf:quarkus-cxf-deployment (>=1.5.8, <=1.5.10) +454 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8,...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkiverse.cxf:quarkus-cxf (>=1.5.15, <=1.5.17), io.quarkiverse.cxf:quarkus-cxf-deployment (>=1.5.15, <=1.5.17) +133 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.8.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf =1.5.15, =1.5.15, =1.5.15, =1.5.15, =1.5.15, =1.5.15, =1.5.15,...

io.github.project-openubl:quarkus-xsender (>=4.0.0.beta1, <=4.0.0.beta4), io.github.project-openubl:quarkus-xsender-deployment (>=4.0.0.beta1, <=4.0.0.beta4) +119 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.14.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.github.project-openubl:quarkus-xsender =4.0.0.beta1, =4.0.0.beta1, =1.7.1, =2.0.0 and more...

io.quarkus:quarkus-amazon-lambda-http (2.15.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (2.15.0.cr1) +101 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.15.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.15.0.cr1 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (0.21.0), io.automatiko.addons:automatiko-events-websocket-addon (0.21.0) +165 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.15.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon 0.21.0 -...

io.quarkiverse.neo4j:quarkus-neo4j-integration-tests (>=1.8.0, <=2.1.0), io.quarkiverse.omnifaces:quarkus-omnifaces (3.0.3) +119 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.15.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.neo4j:quarkus-neo4j-integration-tests =1.8.0, =2.1.0 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (>=0.22.0, <=0.23.0), io.automatiko.addons:automatiko-events-websocket-addon (>=0.22.0, <=0.23.0) +144 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.16.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon =0.22.0, =0.22.0, =0.22.0, =0.22.0...

io.quarkiverse.cxf:quarkus-cxf (0.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (0.1.1) +390 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.10.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 0.1.1 - io.quarkiverse.cxf:quarkus-cxf-deployment 0.1.1 -...

io.quarkiverse.githubapp:quarkiverse-github-app (0.0.1), io.quarkiverse.githubapp:quarkiverse-github-app-deployment (0.0.1) +75 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.10.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkiverse-github-app 0.0.1 -...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.6.5, <=1.6.20), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (>=1.6.5, <=1.6.20) +106 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.11.7.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.6.5, =1.6.5, =1.6.5, =1.6.5, =1.6.5,...

com.github.adminfaces:quarkus-omnifaces (1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (1.4.0) +120 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.13.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.adminfaces:quarkus-omnifaces 1.4.0 -...