CVE-2026-102475

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

EUVD-2026-101928

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-102475

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer CVE-2026-40859 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-netty-http and camel-vertx-http components, tracked as CVE-2026-40859. When a producer endpoint is configured...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data

A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the camel-vertx-http component deserializing attacker-controlled Java objects without an ObjectInputFilter when transferException or allowJavaSerializedObject is enabled, which allows an attacker...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data

A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...

io.quarkiverse.renarde:quarkus-renarde (1.0.1), io.quarkiverse.renarde:quarkus-renarde-backoffice (1.0.1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.renarde:quarkus-renarde 1.0.1 - io.quarkiverse.renarde:quarkus-renarde-backoffice...

io.quarkus:quarkus-amazon-lambda-http (1.7.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.4.final) +68 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.4.final -...

io.quarkus:quarkus-amazon-lambda-http (1.10.1.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.10.1.final) +72 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.10.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.10.1.final -...

io.quarkus:quarkus-amazon-lambda-http (1.11.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.11.4.final) +174 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.11.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.11.4.final -...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.9.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.9.38, <=1.20.1) +1794 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.0.0.alpha1, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.alpha1, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.1, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

io.quarkiverse.githubapp:quarkus-github-app (1.2.1), io.quarkiverse.githubapp:quarkus-github-app-deployment (1.2.1) +638 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app 1.2.1 -...

io.quarkus:quarkus-amazon-lambda-http (2.10.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.10.4.final) +105 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.10.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.10.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.10.4.final -...

com.github.t1:wunderbar.demo.product (2.4.8), io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.1.3) +632 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.11.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.11.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.t1:wunderbar.demo.product 2.4.8 -...

com.github.fmcejudo:quarkus-eureka (0.0.5), com.github.fmcejudo:quarkus-eureka-deployment (0.0.5) +118 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.0.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.fmcejudo:quarkus-eureka 0.0.5 - com.github.fmcejudo:quarkus-eureka-deployment 0.0.5 ...

io.quarkus:quarkus-amazon-lambda-http (2.1.4.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.1.4.final) +105 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.1.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.1.4.final -...