CVE-2023-4853: Quarkus: http security policy bypass

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-20 · updated 2026-08-04
Weakness: CWE-148

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected products

quarkusio quarkus: before 2.16.11; from 3.2.0 before 3.2.6; from 3.3.0 before 3.3.3 — fixed in 2.16.11, 3.2.6, 3.3.3
RedHat Build Of Optaplanner: 8.0
Red Hat build of Quarkus: from 2.13.0 before 2.13.8 — fixed in 2.13.8
RedHat Decision Manager: 7.0
RedHat Integration Camel K: before 1.10.2 — fixed in 1.10.2
RedHat Integration Camel Quarkus: all versions
RedHat Integration Service Registry: all versions
RedHat Jboss Middleware: 1
RedHat Jboss Middleware Text-Only Advisories: 1.0
Red Hat OpenShift Container Platform 4.18: 4.10, 4.11, 4.12
Red Hat OpenShift Serverless: 1.0
Red Hat Process Automation Manager 7: 7.0

How to fix

Upgrade to a fixed version: quarkusio quarkus 2.16.11, 3.2.6, 3.3.3; Red Hat build of Quarkus 2.13.8; RedHat Integration Camel K 1.10.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4853 or the next vulnerability affects your stack