CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

io.quarkus:quarkus-amazon-lambda-http (>=3.27.4.1, <=3.27.5.2), io.quarkus:quarkus-amazon-lambda-http-deployment (>=3.27.4.1, <=3.27.5.2) +377 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.27.4.1, <=3.27.5.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.5.2 and more Source cves: CVE-2026-87743 Source advisory:...

ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test (>=2.7.0-rc-1, <=2.7.1), ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-jackson-integration-test (>=2.7.0-rc-1, <=2.7.1) +711 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.39.0, <=3.39.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.39.0, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (1.34.0), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (1.34.0) +619 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.33.2.1, <=3.33.3.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.33.2.1, =0.6.5, =0.6.5, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.13.1 and more Source cves: CVE-2026-87743 S...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.apicurio:apicurio-registry-app (1.1.2.final), io.apicurio:apicurio-registry-common (1.1.2.final) +58 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.2.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.apicurio:apicurio-registry-app 1.1.2.final - io.apicurio:apicurio-registry-common 1.1.2.fina...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (>=1.9.0, <=1.9.2), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (>=1.9.0, <=1.9.2) +104 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.2 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (0.10.0), io.automatiko.addons:automatiko-events-websocket-addon (0.10.0) +131 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.4.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon 0.10.0 -...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.6.5, <=1.6.20), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (>=1.6.5, <=1.6.20) +106 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.11.7.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.11.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.6.5, =1.6.5, =1.6.5, =1.6.5, =1.6.5,...

io.quarkus:quarkus-amazon-lambda-http (1.7.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.0.cr1) +68 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

com.github.mcollovati:quarkus-hilla-deployment (1.0.0-alpha1), com.vaadin:vaadin-quarkus (>=1.0.1, <=1.1.3) +641 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.6.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.mcollovati:quarkus-hilla-deployment 1.0.0-alpha1 - com.vaadin:vaadin-quarkus =1.0.1,...

io.quarkiverse.githubapp:quarkus-github-app (>=1.5.0, <=1.6.0), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.5.0, <=1.6.0) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.6.0 -...

io.quarkus:quarkus-amazon-lambda-http (1.3.0.cr2), io.quarkus:quarkus-amazon-lambda-http-deployment (1.3.0.cr2) +51 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.3.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 1.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.3.0.cr2 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

com.trendyol:kediatr-quarkus-starter (1.0.0), io.automatiko.addons:automatiko-cassandra-persistence-addon (0.11.0) +120 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.trendyol:kediatr-quarkus-starter 1.0.0 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (0.12.0), io.automatiko.addons:automatiko-events-websocket-addon (0.12.0) +304 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.6.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon 0.12.0 -...

io.quarkiverse.neo4j:quarkus-neo4j-integration-tests (1.4.1), io.quarkus:quarkus-amazon-lambda-http (2.11.3.final) +151 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.11.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.11.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.neo4j:quarkus-neo4j-integration-tests 1.4.1 -...

com.alibaba:ageiport-task-server (>=0.0.1, <=0.2.7), com.dropchop.quarkus:snakejar-example (>=1.0.8, <=1.0.13) +331 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.9.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.alibaba:ageiport-task-server =0.0.1, =1.0.8, =0.16.0, =0.16.0, =0.16.0, =0.16.0, =0.16.0,...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.0.alpha2), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.0.alpha2) +131 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.0.alpha2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.0.alpha2 -...

io.quarkus:quarkus-amazon-lambda-http (1.7.3.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.7.3.final) +69 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.7.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.7.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.7.3.final -...