CVE-2026-87743

HIGH 7.5

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

CVSS Score

7.5

EPSS Score

0.5%

EPSS Percentile

44th

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

CWE	CWE-551
Vendor	red hat
Product	red hat build of quarkus 3.27.5.sp2
Published	Sep 18, 2026
Last Updated	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat build of quarkus 3.27.5.sp2

Be the first to know when new high vulnerabilities affecting red hat red hat build of quarkus 3.27.5.sp2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat build of Quarkus 3.27.5.SP2

All versions affected

Red Hat / Red Hat build of Quarkus 3.33.3.SP2

All versions affected

Red Hat / Red Hat OpenShift Dev Spaces 3.31

All versions affected

Red Hat / Exploit Intelligence

All versions affected