CVE-2023-4853
Quarkus: http security policy bypass
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Quarkus: http security policy bypass
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Record
CVE-2023-4853- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-148
- Updated
- 2026-11-04
EUVDEUVD-2023-2416
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Record
EUVD-2023-2416- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-4f4r-wgv2-jjvg
Quarkus HTTP vulnerable to incorrect evaluation of permissions
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Record
GHSA-4f4r-wgv2-jjvg- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-148, CWE-863
- Updated
- 2026-11-02
NVD
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Record
CVE-2023-4853- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-148, CWE-863
- Updated
- 2026-11-04
OSV
Quarkus: http security policy bypass
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Record
CVE-2023-4853- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-148
- Updated
- 2026-11-05
OSVGHSA-4f4r-wgv2-jjvg
Quarkus HTTP vulnerable to incorrect evaluation of permissions
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
- Record
GHSA-4f4r-wgv2-jjvg- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-148, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2023:5479
Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.30.1 security update
- Record
RHSA-2023:5479- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
- quarkus
- red hat openshift serverless 1 on rhel 8
- red hat build of optaplanner 8
- red hat build of quarkus
- red hat build of quarkus 2.13.8.sp2
- red hat camel extensions for quarkus 2.13.3-1
- red hat integration camel quarkus 2
- red hat openshift serverless 1.30
- red hat process automation 7
- red hat rhel-8 based middleware containers
- red hat rhint camel-k-1.10.2
- red hat rhint service registry 2.5.4 ga
Show 12 moreShow less
- red hat rhpam 7.13.4 async
- redhat build of optaplanner
- redhat build of quarkus
- redhat decision manager
- redhat integration camel k
- redhat integration camel quarkus
- redhat integration service registry
- redhat jboss middleware
- redhat jboss middleware text-only advisories
- redhat openshift container platform
- redhat openshift serverless
- redhat process automation manager
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-vertx-httpMaven |
before 2.16.11.Final | 2.16.11.Final |
io.quarkus:quarkus-vertx-httpMaven |
3.0.0 up to 3.2.6.Final | 3.2.6.Final |
io.quarkus:quarkus-vertx-httpMaven |
3.3.0 up to 3.3.3 | 3.3.3 |
io.quarkus:quarkus-undertowMaven |
before 2.16.11.Final | 2.16.11.Final |
io.quarkus:quarkus-undertowMaven |
3.0.0 up to 3.2.6.Final | 3.2.6.Final |
io.quarkus:quarkus-undertowMaven |
3.3.0 up to 3.3.3 | 3.3.3 |
io.quarkus:quarkus-csrf-reactiveMaven |
before 2.16.11.Final | 2.16.11.Final |
io.quarkus:quarkus-csrf-reactiveMaven |
3.0.0 up to 3.2.6.Final | 3.2.6.Final |
io.quarkus:quarkus-csrf-reactiveMaven |
3.3.0 up to 3.3.3 | 3.3.3 |
io.quarkus:quarkus-keycloak-authorizationMaven |
before 2.16.11.Final | 2.16.11.Final |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
io.quarkus:quarkus-keycloak-authorizationMaven |
3.0.0 up to 3.2.6.Final | 3.2.6.Final |
io.quarkus:quarkus-keycloak-authorizationMaven |
3.3.0 up to 3.3.3 | 3.3.3 |
io.quarkus:quarkus-vertx-httpMaven |
before 2.16.11.Final, plus listed versions 0.23.00.23.10.23.20.24.00.25.0 Show 45 moreShow less0.26.00.26.10.27.00.28.00.28.11.0.0.CR11.0.0.CR21.0.0.Final1.0.1.Final1.1.0.CR11.1.0.Final1.1.1.Final1.10.0.CR11.10.0.Final1.10.1.Final1.10.2.Final1.10.3.Final1.10.4.Final1.10.5.Final1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final1.2.0.CR11.2.0.Final |
2.16.11.Final |
io.quarkus:quarkus-vertx-httpMaven |
3.0.0 up to 3.2.6.Final, plus listed versions 3.0.0.Final3.0.1.Final3.0.2.Final3.0.3.Final3.0.4.Final Show 12 moreShow less3.1.0.CR13.1.0.Final3.1.1.Final3.1.2.Final3.1.3.Final3.2.0.CR13.2.0.Final3.2.1.Final3.2.2.Final3.2.3.Final3.2.4.Final3.2.5.Final |
3.2.6.Final |
io.quarkus:quarkus-vertx-httpMaven |
3.3.0 up to 3.3.3, plus listed versions 3.3.13.3.2 |
3.3.3 |
io.quarkus:quarkus-undertowMaven |
before 2.16.11.Final, plus listed versions 0.11.00.12.00.13.00.13.10.13.2 Show 45 moreShow less0.13.30.14.00.15.00.16.00.16.10.17.00.18.00.19.00.19.10.20.00.21.00.21.10.21.20.22.00.23.00.23.10.23.20.24.00.25.00.26.00.26.10.27.00.28.00.28.11.0.0.CR11.0.0.CR21.0.0.Final1.0.1.Final1.1.0.CR11.1.0.Final1.1.1.Final1.10.0.CR11.10.0.Final1.10.1.Final1.10.2.Final1.10.3.Final1.10.4.Final1.10.5.Final1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final1.11.2.Final1.11.3.Final |
2.16.11.Final |
io.quarkus:quarkus-undertowMaven |
3.0.0 up to 3.2.6.Final, plus listed versions 3.0.0.Final3.0.1.Final3.0.2.Final3.0.3.Final3.0.4.Final Show 12 moreShow less3.1.0.CR13.1.0.Final3.1.1.Final3.1.2.Final3.1.3.Final3.2.0.CR13.2.0.Final3.2.1.Final3.2.2.Final3.2.3.Final3.2.4.Final3.2.5.Final |
3.2.6.Final |
io.quarkus:quarkus-undertowMaven |
3.3.0 up to 3.3.3, plus listed versions 3.3.13.3.2 |
3.3.3 |
io.quarkus:quarkus-csrf-reactiveMaven |
before 2.16.11.Final, plus listed versions 2.13.0.CR12.13.0.Final2.13.1.Final2.13.2.Final2.13.3.Final Show 28 moreShow less2.13.4.Final2.13.5.Final2.13.6.Final2.13.7.Final2.13.8.Final2.13.9.Final2.14.0.CR12.14.0.Final2.14.1.Final2.14.2.Final2.14.3.Final2.15.0.CR12.15.0.Final2.15.1.Final2.15.2.Final2.15.3.Final2.16.0.CR12.16.0.Final2.16.1.Final2.16.10.Final2.16.2.Final2.16.3.Final2.16.4.Final2.16.5.Final2.16.6.Final2.16.7.Final2.16.8.Final2.16.9.Final |
2.16.11.Final |
io.quarkus:quarkus-csrf-reactiveMaven |
3.0.0 up to 3.2.6.Final, plus listed versions 3.0.0.Final3.0.1.Final3.0.2.Final3.0.3.Final3.0.4.Final Show 12 moreShow less3.1.0.CR13.1.0.Final3.1.1.Final3.1.2.Final3.1.3.Final3.2.0.CR13.2.0.Final3.2.1.Final3.2.2.Final3.2.3.Final3.2.4.Final3.2.5.Final |
3.2.6.Final |
io.quarkus:quarkus-csrf-reactiveMaven |
3.3.0 up to 3.3.3, plus listed versions 3.3.13.3.2 |
3.3.3 |
io.quarkus:quarkus-keycloak-authorizationMaven |
before 2.16.11.Final, plus listed versions 0.27.00.28.00.28.11.0.0.CR11.0.0.CR2 Show 45 moreShow less1.0.0.Final1.0.1.Final1.1.0.CR11.1.0.Final1.1.1.Final1.10.0.CR11.10.0.Final1.10.1.Final1.10.2.Final1.10.3.Final1.10.4.Final1.10.5.Final1.11.0.Beta11.11.0.Beta21.11.0.CR11.11.0.Final1.11.1.Final1.11.2.Final1.11.3.Final1.11.4.Final1.11.5.Final1.11.6.Final1.11.7.Final1.12.0.CR11.12.0.Final1.12.1.Final1.12.2.Final1.13.0.CR11.13.0.Final1.13.1.Final1.13.2.Final1.13.3.Final1.13.4.Final1.13.5.Final1.13.6.Final1.13.7.Final1.2.0.CR11.2.0.Final1.2.1.Final1.3.0.Alpha11.3.0.Alpha21.3.0.CR11.3.0.CR21.3.0.Final1.3.1.Final |
2.16.11.Final |
io.quarkus:quarkus-keycloak-authorizationMaven |
3.0.0 up to 3.2.6.Final, plus listed versions 3.0.0.Final3.0.1.Final3.0.2.Final3.0.3.Final3.0.4.Final Show 12 moreShow less3.1.0.CR13.1.0.Final3.1.1.Final3.1.2.Final3.1.3.Final3.2.0.CR13.2.0.Final3.2.1.Final3.2.2.Final3.2.3.Final3.2.4.Final3.2.5.Final |
3.2.6.Final |
io.quarkus:quarkus-keycloak-authorizationMaven |
3.3.0 up to 3.3.3, plus listed versions 3.3.13.3.2 |
3.3.3 |
openshift-serverless-clientsRed Hat:serverless:1.0::el8 |
before 0:1.9.2-3.el8 | 0:1.9.2-3.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, products | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4853 is a high vulnerability (CVSS 8.1) in Quarkus, published September 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.28%, the 83rd percentile. Fixed in io.quarkus:quarkus-vertx-http 2.16.11.Final.
References
access.redhat.com/errata/RHSA-2023:5170
Show 23 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2238034
nvd.nist.gov/vuln/detail/CVE-2023-4853
github.com/quarkusio/quarkus/issues/35785
catalog.redhat.com/software/containers
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5479.json
cve.org/CVERecord?id=CVE-2023-4853
Left out here: 453 versions. The JSON record has them.