3811 matches found
CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...
ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test (>=2.7.0-rc-1, <=2.7.1), ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-jackson-integration-test (>=2.7.0-rc-1, <=2.7.1) +707 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.39.0, <=3.39.4)
io.quarkus:quarkus-vertx-http MAVEN version =3.39.0, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-...
EUVD-2026-82862
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...
CVE-2026-87743
CVE-2026-87743 is an authorization bypass in Quarkus HTTP security (quarkus-vertx-http). The root cause is a path normalization discrepancy between the security matcher and HTTP request dispatchers: an unauthenticated attacker can craft a URL that the security matcher treats as public, but which ...
io.quarkus:quarkus-amazon-lambda-http (>=3.27.4.1, <=3.27.5.2), io.quarkus:quarkus-amazon-lambda-http-deployment (>=3.27.4.1, <=3.27.5.2) +377 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.27.4.1, <=3.27.5.2)
io.quarkus:quarkus-vertx-http MAVEN version =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.5.2 and more Source cves: CVE-2026-87743 Source advisory:...
ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (1.34.0), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (1.34.0) +618 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.33.2.1, <=3.33.3.2)
io.quarkus:quarkus-vertx-http MAVEN version =3.33.2.1, =0.6.5, =0.6.5, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.13.1 and more Source cves: CVE-2026-87743 S...
CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...
PT-2026-95342
Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description An issue exists in Quarkus HTTP security where a discrepancy in path normalization between the security matcher and HTTP request dispatchers can be exploited. An unauthenticated attacker can...
CVE-2026-93432: Improper Neutralization of Input During Web Page Generation
A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...
PT-2026-95587
Name of the Vulnerable Software and Affected Versions Quarkus Qute affected versions not specified Description A flaw in the Quarkus Qute template engine occurs when the eval section helper processes a sub-template and fails to pass the parent template's content type information. This failure...
CVE-2026-87743: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...
CVE-2026-87742
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...
CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...
com.julien-dubois.bootui:bootui-quarkus (>=1.15.0, <=1.19.0), io.quarkiverse.langchain4j:quarkus-langchain4j-chat-scopes-websocket (>=1.9.1, <=1.14.2) +10 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.33.0.cr1, <=3.33.3.2)
io.quarkus:quarkus-websockets-next MAVEN version =3.33.0.cr1, =1.15.0, =1.9.1, =1.9.1, =1.9.0.cr1, =1.9.0.cr1, =1.9.0.cr1, =1.10.5, =1.10.5, =1.10.5, =1.12.0, =3.33.0.cr1, =3.33.0.cr1, =3.33.3.2 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...
EUVD-2026-81675
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...
io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot (>=1.5.0.cr1, <=1.8.4), io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot-deployment (>=1.5.0.cr1, <=1.8.4) +5 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.27.0.cr1, <=3.27.5.2)
io.quarkus:quarkus-websockets-next MAVEN version =3.27.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =1.7.0, =1.7.0, =1.7.0, =3.27.0.cr1, =3.27.0.cr1, =3.27.5.2 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...
CVE-2026-87742
A flaw in quarkus-websockets-next allows a remote attacker to trigger a Denial of Service by streaming messages over a single connection faster than the application can process them. The root cause is unbounded message buffering combined with a lack of read backpressure , which rapidly exhausts h...
CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering
A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...
CVE-2026-81829 Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver
A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWSALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid heade...
CVE-2026-87743
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...