High

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Type: advisorySource: Official CVE List1 source record

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Announced 18 Sept 2026Source revision 1

Original source ↗

CVE-2026-87743

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87743

Red Hat build of Quarkus 3.27.5.SP2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus 3.33.3.SP2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Exploit Intelligence

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apicurio Registry 3

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Debezium 3

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Fuse 7

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift AI (RHOAI)

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat OpenShift Dev Spaces

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.27::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.27.5.SP2",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3.33::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus 3.33.3.SP2",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:exploit_intelligence:0"
    ],
    "vendor": "Red Hat",
    "product": "Exploit Intelligence",
    "packageName": "exploit-intelligence/agent-client-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:apicurio_registry:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apicurio Registry 3",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:debezium:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Debezium 3",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "keycloak/rhbk-openshift-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "keycloak/rhbk-rhel9-operator",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "rhbk/keycloak-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "rhbk/keycloak-rhel9-operator",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7",
    "packageName": "quarkus-vertx-http",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:openshift_ai"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift AI (RHOAI)",
    "packageName": "rhoai/odh-trustyai-service-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:openshift_devspaces:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Dev Spaces",
    "packageName": "devspaces/multicluster-redirector-rhel9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  }
]

Related CVEs: CVE-2026-87743
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #16334 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:14:07 GMT
Publisher date: Fri, 18 Sep 2026 09:38:27 GMT

Read the original announcement