CVE-2026-87743

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743

CVE-2026-87743 is an authorization bypass in Quarkus HTTP security (quarkus-vertx-http). The root cause is a path normalization discrepancy between the security matcher and HTTP request dispatchers: an unauthenticated attacker can craft a URL that the security matcher treats as public, but which ...

EUVD-2026-82862

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

EUVD-2024-3462

Malicious code in bioql PyPI...

Security Bulletin: Vulnerabilities in Quarkus-HTTP affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Potential vulnerability in Quarkus-HTTP has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-12397 DESCRIPTION: A...

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

Linux Distros Unpatched Vulnerability : CVE-2024-12397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an...

Cookie Poisoning

Quarkus-HTTP is vulnerable to Cookie Poisoning. The vulnerability is due to improper parsing of cookies with specific value-delimiting characters, allowing attackers to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values...

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorize...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=0.26.0, <=1.2.1.final), io.quarkus.http:quarkus-http-servlet (3.0.0.beta1) +25 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.beta1)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =0.26.0, =0.26.0, =0.26.0, =0.24.0,...

io.quarkus.http:quarkus-http-servlet (3.0.0.final), io.quarkus.http:quarkus-http-websockets-jsr (3.0.0.final) +28 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.0.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.0.final -...

com.github.ideahut:qms-shared (1.0.0), com.github.ideahut:qms-shared-core (1.0.0) +39 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.1.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.github.ideahut:qms-shared 1.0.0 - com.github.ideahut:qms-shared-core 1.0.0 -...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.3.0.alpha1, <=1.3.0.alpha2), io.apicurio:apicurio-registry-app (1.1.2.final) +40 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.2.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =1.3.0.alpha1, =1.3.0.alpha1,...

gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.3.0.cr1, <=1.3.0.final), io.quarkus.http:quarkus-http-servlet (3.0.3.final) +38 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.3.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - gradle.plugin.io.quarkus:quarkus-gradle-plugin =1.3.0.cr1, =1.3.0.cr1, =1.3.0.cr1,...

io.quarkus.http:quarkus-http-servlet (3.0.5.final), io.quarkus.http:quarkus-http-websockets-jsr (3.0.5.final) potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.5.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - io.quarkus.http:quarkus-http-servlet 3.0.5.final -...

com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha3), gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.3.3.final, <=1.4.2.final) +29 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.7.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base 1.5.0-alpha3 -...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.5.0-alpha4, <=1.5.0-alpha5), gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.5.0.final, <=1.5.2.final) +45 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.9.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.5.0-alpha4, =1.5.0.final,...

com.github.shumonsharif:quarkus-cxf (1.0.0-alpha-01), com.github.shumonsharif:quarkus-cxf-deployment (1.0.0-alpha-01) +45 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.11.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.github.shumonsharif:quarkus-cxf 1.0.0-alpha-01 -...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.5.0, <=1.6.0-alpha1), gradle.plugin.io.quarkus:quarkus-gradle-plugin (>=1.7.0.final, <=1.8.0.final) +49 more potentially affected by CVE-2024-12397 via io.quarkus.http:quarkus-http-core (3.0.14.final)

io.quarkus.http:quarkus-http-core MAVEN version 3.0.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus.http:quarkus-http-core and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.5.0, =1.7.0.final, =1.2.3.fina...