A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
CVE-2023-4853
CVSS base score
8.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-148, CWE-863
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
quarkus quarkus
redhat build of optaplanner
redhat build of quarkus
redhat decision manager
redhat integration camel k
redhat integration camel quarkus
redhat integration service registry
redhat jboss middleware
redhat jboss middleware text-only advisories
redhat openshift serverless
References
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Vendor Advisory
- access.redhat.com Mitigation, Vendor Advisory