Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes in the request path. An attacker can gain unauthorized...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...

io.quarkus:quarkus-rest-servlet (>=3.34.0.cr1, <=3.34.6), io.quarkus:quarkus-rest-servlet-deployment (>=3.34.0.cr1, <=3.34.6) +6 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-undertow (>=3.34.0.cr1, <=3.34.6)

io.quarkus:quarkus-undertow MAVEN version =3.34.0.cr1, =3.34.0.cr1, =3.34.0.cr1, =3.34.0.cr1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.8 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420253...

io.quarkus:quarkus-undertow-deployment (1.8.1.final), io.quarkus:quarkus-undertow-websockets (1.8.1.final) +1 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.8.1.final)

io.quarkus:quarkus-undertow MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.8.1.final - io.quarkus:quarkus-undertow-websockets...

io.quarkus:quarkus-amazon-lambda (0.11.0), io.quarkus:quarkus-elytron-security (0.11.0) +10 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.11.0)

io.quarkus:quarkus-undertow MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-amazon-lambda 0.11.0 - io.quarkus:quarkus-elytron-security 0.11.0 -...

io.quarkus:quarkus-undertow-deployment (1.3.0.final), io.quarkus:quarkus-undertow-websockets (1.3.0.final) +12 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.3.0.final)

io.quarkus:quarkus-undertow MAVEN version 1.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.3.0.final - io.quarkus:quarkus-undertow-websockets...

io.quarkus:quarkus-undertow-deployment (1.2.0.cr1), io.quarkus:quarkus-undertow-websockets (1.2.0.cr1) +1 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.2.0.cr1)

io.quarkus:quarkus-undertow MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.2.0.cr1 - io.quarkus:quarkus-undertow-websockets 1.2.0.cr1 -...

com.github.adminfaces:quarkus-omnifaces (1.2.0), com.github.adminfaces:quarkus-omnifaces-deployment (1.2.0) +15 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.12.0.final)

io.quarkus:quarkus-undertow MAVEN version 1.12.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - com.github.adminfaces:quarkus-omnifaces 1.2.0 - com.github.adminfaces:quarkus-omnifaces-deployment...

io.quarkus:quarkus-undertow-deployment (1.4.2.final), io.quarkus:quarkus-undertow-websockets (1.4.2.final) +2 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.4.2.final)

io.quarkus:quarkus-undertow MAVEN version 1.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.4.2.final - io.quarkus:quarkus-undertow-websockets...

io.quarkus:quarkus-undertow-deployment (1.4.1.final), io.quarkus:quarkus-undertow-websockets (1.4.1.final) +9 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.4.1.final)

io.quarkus:quarkus-undertow MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.4.1.final - io.quarkus:quarkus-undertow-websockets...

io.quarkus:quarkus-undertow-deployment (1.6.0.cr1), io.quarkus:quarkus-undertow-websockets (1.6.0.cr1) +1 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.6.0.cr1)

io.quarkus:quarkus-undertow MAVEN version 1.6.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.6.0.cr1 - io.quarkus:quarkus-undertow-websockets 1.6.0.cr1 -...

com.github.shumonsharif:quarkus-cxf (1.0.0-alpha-01), com.github.shumonsharif:quarkus-cxf-deployment (1.0.0-alpha-01) +15 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.6.0.final)

io.quarkus:quarkus-undertow MAVEN version 1.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - com.github.shumonsharif:quarkus-cxf 1.0.0-alpha-01 - com.github.shumonsharif:quarkus-cxf-deployment...

io.quarkus:quarkus-undertow-deployment (1.7.0.cr1), io.quarkus:quarkus-undertow-websockets (1.7.0.cr1) +1 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.7.0.cr1)

io.quarkus:quarkus-undertow MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.7.0.cr1 - io.quarkus:quarkus-undertow-websockets 1.7.0.cr1 -...

io.quarkus:quarkus-elytron-security (0.21.0), io.quarkus:quarkus-elytron-security-deployment (0.21.0) +32 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.21.0)

io.quarkus:quarkus-undertow MAVEN version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-elytron-security 0.21.0 - io.quarkus:quarkus-elytron-security-deployment 0.21.0 -...

com.pro-crafting.tools:jsonpretty-web (1.0.1), io.quarkus:quarkus-elytron-security (0.22.0) +65 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.22.0)

io.quarkus:quarkus-undertow MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - com.pro-crafting.tools:jsonpretty-web 1.0.1 - io.quarkus:quarkus-elytron-security 0.22.0 -...

io.quarkus:quarkus-smallrye-opentracing (0.25.0), io.quarkus:quarkus-smallrye-opentracing-deployment (0.25.0) +6 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.25.0)

io.quarkus:quarkus-undertow MAVEN version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-smallrye-opentracing 0.25.0 - io.quarkus:quarkus-smallrye-opentracing-deployment 0.25...

io.apicurio:apicurio-registry-app (1.0.2.final), io.apicurio:apicurio-registry-storage-infinispan (1.0.2.final) +19 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.26.1)

io.quarkus:quarkus-undertow MAVEN version 0.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.apicurio:apicurio-registry-app 1.0.2.final - io.apicurio:apicurio-registry-storage-infinispan...

io.quarkus:quarkus-smallrye-opentracing (0.27.0), io.quarkus:quarkus-smallrye-opentracing-deployment (0.27.0) +14 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (0.27.0)

io.quarkus:quarkus-undertow MAVEN version 0.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-smallrye-opentracing 0.27.0 - io.quarkus:quarkus-smallrye-opentracing-deployment 0.27...

io.quarkus:quarkus-undertow-deployment (1.0.1.final), io.quarkus:quarkus-undertow-websockets (1.0.1.final) +9 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.0.1.final)

io.quarkus:quarkus-undertow MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.0.1.final - io.quarkus:quarkus-undertow-websockets...

io.quarkus:quarkus-undertow-deployment (1.1.0.final), io.quarkus:quarkus-undertow-websockets (1.1.0.final) +6 more potentially affected by CVE-2023-4853 via io.quarkus:quarkus-undertow (1.1.0.final)

io.quarkus:quarkus-undertow MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-undertow-deployment 1.1.0.final - io.quarkus:quarkus-undertow-websockets...