CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.9.0), io.quarkiverse.reactivemessaging.http:quarkus-reactive-messaging-http (>=1.1.4, <=1.1.5) +227 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.16.8.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.9.0 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (0.15.0), io.automatiko.addons:automatiko-events-websocket-addon (0.15.0) +117 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.8.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon 0.15.0 -...

com.github.adminfaces:quarkus-omnifaces (1.4.0), com.github.adminfaces:quarkus-omnifaces-deployment (1.4.0) +120 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.13.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.adminfaces:quarkus-omnifaces 1.4.0 -...

com.sellware.quarkus-temporal:temporal-client-integration-tests (2.0.0), io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta5) +112 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.2.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.sellware.quarkus-temporal:temporal-client-integration-tests 2.0.0 -...

com.qwlabs.doraemon:graphql (>=0.1.2, <=0.1.8), io.debezium:debezium-server (>=1.8.0.cr1, <=1.8.1.final) +614 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.qwlabs.doraemon:graphql =0.1.2, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1,...

com.vaadin:vaadin-quarkus (1.0.0), com.vaadin:vaadin-quarkus-deployment (1.0.0) +672 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.3.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.vaadin:vaadin-quarkus 1.0.0 - com.vaadin:vaadin-quarkus-deployment 1.0.0 -...

io.apicurio:apicurio-registry-common (>=1.2.2.final, <=1.2.3.final), io.quarkus:quarkus-amazon-lambda-http (1.3.3.final) +54 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.3.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.apicurio:apicurio-registry-common =1.2.2.final, =1.2.3.final -...

io.quarkus:quarkus-amazon-lambda-http (1.7.6.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.6.final) +68 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.6.final -...

com.radcortez.flyway:flyway-junit5-quarkus (1.2.0), io.github.trikorasolns:keycloak-quarkus-client (>=0.0.2, <=0.0.4) +225 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.2.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.2.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.radcortez.flyway:flyway-junit5-quarkus 1.2.0 - io.github.trikorasolns:keycloak-quarkus-clie...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.5.0-alpha4, <=1.5.0-alpha5), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (>=1.5.0-alpha4, <=1.5.0-alpha5) +249 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.5.0-alpha4, =1.5.0-alpha4, =1.5.0-alpha...

io.debezium:debezium-quarkus-outbox-deployment (>=1.4.0.final, <=1.5.0.alpha1), io.debezium:debezium-server (>=1.4.0.final, <=1.5.0.alpha1) +90 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.11.0.beta2)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.debezium:debezium-quarkus-outbox-deployment =1.4.0.final, =1.4.0.final, =1.4.0.final,...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.0.alpha2), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.0.alpha2) +131 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.0.alpha2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.0.alpha2 -...

io.quarkiverse.loggingsentry:quarkus-logging-sentry-integration-tests (1.2.0), io.quarkiverse.quinoa:quarkus-quinoa (1.1.1) +297 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.10.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.10.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.loggingsentry:quarkus-logging-sentry-integration-tests 1.2.0 -...

io.quarkiverse.neo4j:quarkus-neo4j-integration-tests (1.4.1), io.quarkus:quarkus-amazon-lambda-http (2.11.3.final) +151 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.11.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.neo4j:quarkus-neo4j-integration-tests 1.4.1 -...

br.com.labbs:quarkus-monitor-reactive (1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (1.0.4) +235 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.labbs:quarkus-monitor-reactive 1.0.4 - br.com.labbs:quarkus-monitor-reactive-deployment...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.3.1), io.quarkiverse.cxf:quarkus-cxf (1.5.4) +127 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.3.1 -...

com.abavilla:fpi-bot-api (>=1.0.2, <=1.1.0), com.abavilla:fpi-bot-api-core (>=1.0.2, <=1.1.0) +136 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.12.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.12.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-bot-api =1.0.2, =1.0.2, =1.0.2, =1.0.132, =v1.3.1, =v1.3.1, =1.0.42, =1.0.42,...