CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

io.quarkus:quarkus-amazon-lambda-http (>=3.27.4.1, <=3.27.5.2), io.quarkus:quarkus-amazon-lambda-http-deployment (>=3.27.4.1, <=3.27.5.2) +377 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.27.4.1, <=3.27.5.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.5.2 and more Source cves: CVE-2026-87743 Source advisory:...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (1.34.0), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (1.34.0) +619 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.33.2.1, <=3.33.3.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.33.2.1, =0.6.5, =0.6.5, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.13.1 and more Source cves: CVE-2026-87743 S...

ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test (>=2.7.0-rc-1, <=2.7.1), ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-jackson-integration-test (>=2.7.0-rc-1, <=2.7.1) +711 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.39.0, <=3.39.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.39.0, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.0.cr1), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.0.cr1) +122 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.0.cr1 -...

io.quarkus:quarkus-amazon-lambda-http (1.7.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.0.cr1) +68 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0.cr1, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=0.8.39), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=0.8.39) +312 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.16.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test =0.8.38, =0.8.38, =0.8.3...

io.quarkiverse.renarde:quarkus-renarde (1.0.1), io.quarkiverse.renarde:quarkus-renarde-backoffice (1.0.1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.renarde:quarkus-renarde 1.0.1 - io.quarkiverse.renarde:quarkus-renarde-backoffice...

io.quarkiverse.apicurio:quarkiverse-apicurio-registry-client (0.0.1), io.quarkiverse.apicurio:quarkiverse-apicurio-registry-client-deployment (0.0.1) +370 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.10.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.apicurio:quarkiverse-apicurio-registry-client 0.0.1 -...

io.quarkiverse.githubapp:quarkus-github-app (1.2.1), io.quarkiverse.githubapp:quarkus-github-app-deployment (1.2.1) +638 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app 1.2.1 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (2.0.0.beta1) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 2.0.0.beta1 -...

br.com.senior:seniorx-integration-parameters-api (>=0.0.4-alpha, <=1.0.1), com.datastax.oss.quarkus:cassandra-quarkus-client (1.1.1) +599 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.1.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.senior:seniorx-integration-parameters-api =0.0.4-alpha, =0.6.0, =0.6.0, =0.6.0, =0.6.0,...

io.quarkus:quarkus-amazon-lambda-http (1.0.0.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.0.0.final) +47 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.0.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.0.0.final -...

com.alibaba:ageiport-task-server (>=0.0.1, <=0.2.7), com.dropchop.quarkus:snakejar-example (>=1.0.8, <=1.0.13) +331 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.alibaba:ageiport-task-server =0.0.1, =1.0.8, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =0.16.0,...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.9.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.9.38, <=1.20.1) +1794 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.0.0.alpha1, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.alpha1, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.1, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (5.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (5.0.0.beta1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.14.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 5.0.0.beta1 -...

com.github.mcollovati:quarkus-hilla-deployment (1.0.0-alpha1), com.vaadin:vaadin-quarkus (>=1.0.1, <=1.1.3) +641 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.6.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.mcollovati:quarkus-hilla-deployment 1.0.0-alpha1 - com.vaadin:vaadin-quarkus =1.0.1,...