CVE-2026-87743: Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Other sources
Title: Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security Summary:
A vulnerability in the Quarkus HTTP security matcher allows unauthenticated attackers to bypass path-based access control rules. Because paths are normalized differently between the security matcher and the HTTP request dispatchers (e.g., RESTEasy, Undertow), an attacker can craft a URL that the security matcher treats as public, but the router dispatches to a protected endpoint.This issue is an incomplete fix for CVE-2026-50559. Component: io.quarkus:quarkus-vertx-http CWE: CWE-285, CWE-288, CWE-436 Scoring: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5/10) Affected versions: 3.27, 3.33
Credit: Michael Read (https://github.com/Michael-JRead)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using io.quarkus:quarkus-vertx-http with path-based HTTP security rules may be exposed if a URL can be interpreted as public by the security matcher while being dispatched to a protected endpoint. The listed affected versions are 3.27 and 3.33.
What does an attacker need to exploit the vulnerability?
An attacker can exploit the issue remotely without authentication, user interaction, or special privileges. They need to craft a request URL that triggers the path-normalization discrepancy between the security matcher and the HTTP request dispatcher.
What is the likely impact if exploitation succeeds?
The attacker may bypass path-based authorization controls and reach protected endpoints. The stated impact is unauthorized access to sensitive information; integrity and availability impacts are not indicated by the supplied CVSS vector.
Is this related to an earlier issue?
Yes. The issue is described as an incomplete fix for CVE-2026-50559, so environments that addressed that earlier vulnerability should verify that the remediation fully covers this issue.