GHSA-xqhm-4ph4-423v: Security vulnerability

Published Nov 6, 2026

Updated

A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and access protected resources.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade armeria to a version that resolves this vulnerability.
Fixed in 1.43.0

Event History

Nov 6, 2026

CVE Published

via OSV·07:46 AM

Data Sourced

via OSV·07:46 AM

DescriptionSeverity

Frequently Asked Questions

Who is exposed to this issue?

Applications using armeria versions earlier than 1.43.0 may be exposed if they rely on path-based access controls to protect resources.

What does an attacker need to exploit it?

The issue can be exploited by an unauthenticated attacker. The vulnerability involves inconsistent request-path normalization that can bypass path-based access controls.

Is a default deployment necessarily affected?

The available information does not establish that all default deployments are affected. Exposure depends on whether the application uses path-based access controls for protected resources.

GHSA-xqhm-4ph4-423v: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is a default deployment necessarily affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Is a default deployment necessarily affected?