CVE-2026-40859

camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer CVE-2026-40859 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-netty-http and camel-vertx-http components, tracked as CVE-2026-40859. When a producer endpoint is configured...

CVE-2026-102475

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-102475

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

EUVD-2026-101928

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-102475: Allocation of Resources Without Limits or Throttling

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. This can be used to force a server to indefinitely allocate heap. This vulnerabilit...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (1.34.0), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (1.34.0) +618 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.33.2.1, <=3.33.3.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.33.2.1, =0.6.5, =0.6.5, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.13.1 and more Source cves: CVE-2026-87743 S...

ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test (>=2.7.0-rc-1, <=2.7.1), ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-jackson-integration-test (>=2.7.0-rc-1, <=2.7.1) +707 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.39.0, <=3.39.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.39.0, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-rc-1, =2.7.0-...

io.quarkiverse.cxf:quarkus-cxf (3.40.0.cr1), io.quarkiverse.cxf:quarkus-cxf-deployment (3.40.0.cr1) +161 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (3.40.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 3.40.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 3.40.0.cr1 - io.quarkiverse.cxf:quarkus-cxf-deployment 3.40.0.cr1...

io.quarkus:quarkus-amazon-lambda-http (>=3.27.4.1, <=3.27.5.2), io.quarkus:quarkus-amazon-lambda-http-deployment (>=3.27.4.1, <=3.27.5.2) +377 more potentially affected by CVE-2026-87743 via io.quarkus:quarkus-vertx-http (>=3.27.4.1, <=3.27.5.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.4.1, =3.27.5.2 and more Source cves: CVE-2026-87743 Source advisory:...

org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data

A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the camel-vertx-http component deserializing attacker-controlled Java objects without an ObjectInputFilter when transferException or allowJavaSerializedObject is enabled, which allows an attacker...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data

A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...

io.quarkus:quarkus-azure-functions-http (0.23.2), io.quarkus:quarkus-azure-functions-http-deployment (0.23.2) +49 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (0.23.2)

io.quarkus:quarkus-vertx-http MAVEN version 0.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-azure-functions-http 0.23.2 - io.quarkus:quarkus-azure-functions-http-deployment...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.0.cr1), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.0.cr1) +122 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.0.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.0.cr1 -...

io.quarkus:quarkus-amazon-lambda-http (1.1.0.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.1.0.final) +117 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.1.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.1.0.final -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0.cr1, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-50559 Source advisory: OSV:GHSA-QCXP-GM7M-4J5V...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=0.8.39), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=0.8.39) +312 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.16.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test =0.8.38, =0.8.38, =0.8.3...