732 matches found
Improper Authorization
Quarkus is vulnerable to Improper Authorization. This vulnerability is due to the mishandling of method declarations in abstract Java classes or by Quarkus extensions, leading to unenforced authorization for RestEasy Classic or Reactive JAX-RS endpoints...
Denial Of Service (DoS)
io.quarkus.resteasy.reactive:resteasy-reactive is vulnerable to Denial Of Service. The vulnerability is due to security checks for certain JAX-RS endpoints being performed after serialization, causing increased processing resources to be consumed during HTTP request checks. Attackers with knowled...
cn.sliew:carp-ageiport-server (>=0.0.10 <=0.0.14), com.abavilla:fpi-bot-api (>=1.8.3 <=1.8.5) +231 more potentially affected by CVE-2024-1726 via io.quarkus.resteasy.reactive:resteasy-reactive (>=3.3.0.CR1 <=3.7.3)
io.quarkus.resteasy.reactive:resteasy-reactive MAVEN version =3.3.0.CR1, =0.0.10, =1.8.3, =1.8.3, =1.8.7, =1.8.7, =1.9.7, =1.9.7, =1.10.3, =1.10.3, =1.0.31, =1.0.31, =1.6.3, =1.6.3, =1.5.9, =1.5.9, =1.6.0 and more Source cves: CVE-2024-1726 Source advisory: OSV:GHSA-MV64-86G8-CQQ7...
com.github.mcollovati:quarkus-hilla-commons-deployment (>=2.4.1 <=2.5.0-alpha2), com.github.mcollovati:quarkus-hilla-deployment (>=2.0.0 <=2.5.0-alpha2) +51 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (>=3.3.0 <=3.6.8)
io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version =3.3.0, =2.4.1, =2.0.0, =2.4.1, =0.32.0, =0.32.0, =0.0.0, =0.5.0, =0.2.0, =0.6.3, =0.1.0, =0.1.0, =0.1.0, =0.7.1 and more Source cves: CVE-2023-5675 So...
cn.sliew:carp-ageiport-server (>=0.0.10 <=0.0.14), com.abavilla:fpi-bot-api (>=1.8.1 <=1.8.5) +190 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (>=3.3.0 <=3.6.8)
io.quarkus:quarkus-resteasy-reactive-common MAVEN version =3.3.0, =0.0.10, =1.8.1, =1.8.1, =1.8.6, =1.8.6, =1.9.0, =1.9.0, =1.10.1, =1.10.1, =1.0.29, =1.0.29, =1.6.1, =1.6.1, =1.5.1, =1.5.1, =1.6.0 and more Source cves: CVE-2023-5675 Source advisory: OSV:GHSA-25W4-HFQG-4R52...
io.quarkiverse.cxf:quarkus-cxf-integration-test-hc5 (>=2.7.0 <=2.7.0.CR2), io.quarkiverse.renarde:quarkus-renarde (>=3.0.8 <=3.0.9) +64 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (>=3.7.0 <=3.7.0.CR1)
io.quarkus:quarkus-resteasy-reactive-common MAVEN version =3.7.0, =2.7.0, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.0.9 and more Source cves: CVE-2023-5675 Source advisory: OSV:GHSA-25W4-HFQG-4R52...
io.quarkiverse.renarde:quarkus-renarde-backoffice-deployment (>=3.0.8 <=3.0.9), io.quarkiverse.renarde:quarkus-renarde-deployment (>=3.0.8 <=3.0.9) +26 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (>=3.7.0 <=3.7.0.CR1)
io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version =3.7.0, =3.0.8, =3.0.8, =3.0.8, =3.0.8, =3.7.0, =3.7.0.CR1 - io.quarkus:quarkus-jaxrs-client-reactive-deployment =3.7.0.CR1 - io.quarkus:quarkus-keycloak-admin-client-reactive-deployment =3.7.0.CR1 -...
br.com.labbs:quarkus-monitor-reactive (=1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (=1.0.4) +237 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common (>=1.11.0.Beta1 <=3.2.0.Final)
io.quarkus:quarkus-resteasy-reactive-common MAVEN version =1.11.0.Beta1, =1.0.2, =1.0.2, =1.0.2, =1.3.2, =1.0.132, =1.0.132, =1.0.133, =1.0.42, =1.0.42, =1.0.42, =1.3.2, =1.0.22, =1.0.22, =1.3.3 and more Source cves: CVE-2023-5675 Source advisory: OSV:GHSA-25W4-HFQG-4R52...
io.quarkiverse.jberet:quarkus-jberet (>=0.0.1 <=2.3.0), io.quarkiverse.jberet:quarkus-jberet-deployment (>=0.0.1 <=2.3.0) +74 more potentially affected by CVE-2024-1102 via org.jberet:jberet-core (>=1.0.0.Alpha3 <=2.2.0.Final)
org.jberet:jberet-core MAVEN version =1.0.0.Alpha3, =0.0.1, =0.0.1, =2.0.0, =2.0.0, =0.0.2, =0.0.2, =6.0.0.CR1, =6.1.0.Beta1, =6.1.0.CR1, =7.0.0.CR1, =5.9.0.Beta1, =1.3.0.Beta3, =1.3.0.Final - org.jberet.samples:restReader =1.3.9.SP3 and more Source cves: CVE-2024-1102 Source advisory:...
br.com.labbs:quarkus-monitor-reactive-deployment (=1.0.4), com.github.mcollovati:quarkus-hilla-deployment (>=1.0.0 <=2.0.0-alpha1) +44 more potentially affected by CVE-2023-5675 via io.quarkus:quarkus-resteasy-reactive-common-deployment (>=1.11.0.Beta1 <=3.2.0.Final)
io.quarkus:quarkus-resteasy-reactive-common-deployment MAVEN version =1.11.0.Beta1, =1.0.0, =0.8.0, =0.8.0, =1.0.0, =1.0.3, =0.0.1, =1.0.1, =1.0.0, =1.0.0, =1.30.0, =1.1.1.Final, =2.13.0.CR1, =3.2.0.Final and more Source cves: CVE-2023-5675 Source advisory: OSV:GHSA-25...
Quarkus: security checks in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
Quarkus: authorization flaw in quarkus resteasy reactive and classic
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
GHSA-25W4-HFQG-4R52 Quarkus: authorization flaw in quarkus resteasy reactive and classic
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...
GHSA-MV64-86G8-CQQ7 Quarkus: security checks in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726
Quarkus RESTEasy Reactive contains a denial-of-service vulnerability (CVE-2024-1726) where security checks for some inherited JAX-RS endpoints are performed after serialization, causing increased resource usage when an attacker knows POST/PUT/PATCH paths. This could lead to DoS as endpoints proce...
CVE-2024-1726 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2024-1726 Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any...
CVE-2023-5675
A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...