CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

io.quarkiverse.renarde:quarkus-renarde (1.0.1), io.quarkiverse.renarde:quarkus-renarde-backoffice (1.0.1) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.renarde:quarkus-renarde 1.0.1 - io.quarkiverse.renarde:quarkus-renarde-backoffice...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.9.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.9.38, <=1.20.1) +1794 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.0.0.alpha1, <=3.20.6.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.alpha1, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.1, =0.0.5 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

io.quarkiverse.githubapp:quarkus-github-app (1.2.1), io.quarkiverse.githubapp:quarkus-github-app-deployment (1.2.1) +638 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app 1.2.1 -...

com.github.mcollovati:quarkus-hilla-deployment (1.0.0-alpha1), com.vaadin:vaadin-quarkus (>=1.0.1, <=1.1.3) +641 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.6.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.mcollovati:quarkus-hilla-deployment 1.0.0-alpha1 - com.vaadin:vaadin-quarkus =1.0.1,...

fr.lixbox.lixbox-param:lixbox-param-core (>=11.1.2.16, <=11.1.2.21), fr.lixbox.lixbox-param:lixbox-param-ui (>=11.1.2.16, <=11.1.2.21) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.6.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - fr.lixbox.lixbox-param:lixbox-param-core =11.1.2.16, =11.1.2.16, =11.1.2.21 -...

com.alibaba:ageiport-task-server (>=0.0.1, <=0.2.7), com.dropchop.quarkus:snakejar-example (>=1.0.8, <=1.0.13) +331 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.alibaba:ageiport-task-server =0.0.1, =1.0.8, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =0.16.0,...

com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha2), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (1.5.0-alpha2) +226 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.4.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base 1.5.0-alpha2 -...

io.apicurio:apicurio-registry-common (>=2.2.4.final, <=2.3.1.final), io.apicurio:apicurio-registry-tenant-manager-api (>=2.2.4.final, <=2.3.1.final) +432 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.7.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.7.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.apicurio:apicurio-registry-common =2.2.4.final, =2.2.4.final, =0.1.0.final, =3.0.8, =3.0.8,...

io.quarkus:quarkus-amazon-lambda-http (1.3.0.cr2), io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.0.cr2) +51 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.3.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.3.0.cr2 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

com.radcortez.flyway:flyway-junit5-quarkus (1.2.0), io.github.trikorasolns:keycloak-quarkus-client (>=0.0.2, <=0.0.4) +225 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.2.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.2.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.radcortez.flyway:flyway-junit5-quarkus 1.2.0 - io.github.trikorasolns:keycloak-quarkus-clie...

com.github.mcollovati:quarkus-hilla-deployment (>=1.0.0-beta1, <=1.3.0), com.vaadin:vaadin-quarkus (1.1.4) +615 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.mcollovati:quarkus-hilla-deployment =1.0.0-beta1, =23.3.13, =1.5.1, =1.5.1, =1.5.1,...

io.dialob:quarkus-app (>=3.0.3, <=3.0.4), io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta4) +142 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.1.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.dialob:quarkus-app =3.0.3, =3.0.4 - io.quarkiverse.operatorsdk:quarkus-operator-sdk...

io.quarkiverse.neo4j:quarkus-neo4j-integration-tests (1.4.1), io.quarkus:quarkus-amazon-lambda-http (2.11.3.final) +151 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.11.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.neo4j:quarkus-neo4j-integration-tests 1.4.1 -...

io.quarkiverse.neo4j:quarkus-neo4j-integration-tests (>=1.8.0, <=2.1.0), io.quarkiverse.omnifaces:quarkus-omnifaces (3.0.3) +119 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.15.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.neo4j:quarkus-neo4j-integration-tests =1.8.0, =2.1.0 -...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.3.1), io.quarkiverse.cxf:quarkus-cxf (1.5.4) +127 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.3.1 -...

com.qwlabs.doraemon:graphql (>=0.1.2, <=0.1.8), io.debezium:debezium-server (>=1.8.0.cr1, <=1.8.1.final) +614 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.qwlabs.doraemon:graphql =0.1.2, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1,...