{"id":"CVE-2023-38493","aliases":["EUVD-2023-2171","GHSA-wvp2-9ppw-337j","ROOT-APP-MAVEN-CVE-2023-38493"],"status":"published","title":"Paths contain matrix variables bypass decorators","description":"Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0072,"percentile":0.54404,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2023-07-25T18:24:39Z","modified":"2026-10-28T10:38:53Z","fixes":[{"ecosystem":"Maven","package":"com.linecorp.armeria:armeria","fixed_in":["1.24.3"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"com.linecorp.armeria:armeria","fixed_in":["1.13.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.linecorp.armeria:armeria","fixed_in":["1.13.4-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.linecorp.armeria:armeria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.24.2"},{"fixed":"1.24.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.linecorp.armeria:armeria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.3"}]}],"versions":["0.10.0.Final","0.11.0.Final","0.12.0.Final","0.12.1.Final","0.12.2.Final","0.13.0.Final","0.13.1.Final","0.13.2.Final","0.13.3.Final","0.13.4.Final","0.14.0.Final","0.15.0.Final","0.16.0.Final","0.16.1.Final","0.17.0.Final","0.18.0.Final","0.19.0.Final","0.20.0.Final","0.20.1.Final","0.20.2.Final","0.20.3.Final","0.21.0.Final","0.21.1.Final","0.21.2.Final","0.21.3.Final","0.21.4.Final","0.21.5.Final","0.21.6.Final","0.22.0.Final","0.23.0.Final","0.23.1.Final","0.24.0.Final","0.24.1.Final","0.25.0.Final","0.26.0.Final","0.26.1.Final","0.27.0.Final","0.28.0.Final","0.29.0.Final","0.29.1.Final","0.30.0.Final","0.31.0.Final","0.31.1.Final","0.32.0","0.33.0","0.33.1","0.34.0","0.34.1","0.35.0","0.35.1","0.35.2","0.36.0","0.37.0","0.38.0","0.39.0","0.4.0.Final","0.40.0","0.41.0","0.42.0","0.43.0","0.44.0","0.45.0","0.46.0","0.46.1","0.46.2","0.46.3","0.46.4","0.47.0","0.48.0","0.49.0","0.5.0.Final","0.5.1.Final","0.50.0","0.51.0","0.52.0","0.52.1","0.53.0","0.53.1","0.53.2","0.54.0","0.54.1","0.54.2","0.55.0","0.55.1","0.56.0","0.56.1","0.57.0","0.58.0","0.58.1","0.59.0","0.59.1","0.59.2","0.6.0.Final","0.6.1.Final","0.6.2.Final","0.6.3.Final","0.6.4.Final","0.60.0","0.61.0","0.62.0","0.63.0","0.63.1","0.64.0","0.65.0","0.65.1","0.66.0","0.67.0","0.67.1","0.67.2","0.68.0","0.68.1","0.68.2","0.69.0","0.7.0.Final","0.70.0","0.70.1","0.71.0","0.71.1","0.72.0","0.73.0","0.74.0","0.74.1","0.75.0","0.76.0","0.76.1","0.76.2","0.77.0","0.78.0","0.78.1","0.78.2","0.79.0","0.8.0.Final","0.80.0","0.81.0","0.81.1","0.82.0","0.83.0","0.84.0","0.85.0","0.86.0","0.87.0","0.88.0","0.89.0","0.89.1","0.9.0.Final","0.90.0","0.90.1","0.90.2","0.90.3","0.91.0","0.92.0","0.93.0","0.94.0","0.95.0","0.96.0","0.97.0","0.98.0","0.98.1","0.98.2","0.98.3","0.98.4","0.98.5","0.98.6","0.98.7","0.99.0","0.99.1","0.99.2","0.99.3","0.99.4","0.99.5","0.99.6","0.99.7","0.99.8","0.99.9","1.0.0","1.1.0","1.10.0","1.11.0","1.12.0","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.14.0","1.14.1","1.15.0","1.16.0","1.16.1","1.16.2","1.16.3","1.17.0","1.17.1","1.17.2","1.18.0","1.19.0","1.2.0","1.20.0","1.20.1","1.20.2","1.20.3","1.21.0","1.22.0","1.22.1","1.23.0","1.23.1","1.24.0","1.24.1","1.24.2","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","1.9.1","1.9.2"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.linecorp.armeria:armeria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.linecorp.armeria:armeria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-root.io.1"}]}]}],"products":[{"vendor":"line","product":"armeria"},{"vendor":"line corporation","product":"armeria"},{"vendor":"linecorp","product":"armeria"}],"references":[{"url":"https://github.com/line/armeria/security/advisories/GHSA-wvp2-9ppw-337j","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/line/armeria/commit/49e04ef231ad65750739529c7fa4ce946ff7588b","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38493","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wvp2-9ppw-337j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38493.json","tags":["advisory"]},{"url":"https://github.com/line/armeria","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-38493","title":"Paths contain matrix variables bypass decorators","description":"Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.","status":"published","published":"2023-07-25T20:51:11.17Z","modified":"2024-10-03T18:47:47.744Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-2171","description":"Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.","status":"published","published":"2023-07-25T20:51:11Z","modified":"2024-10-03T18:47:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:53.790276Z"}],"ghsa":[{"id":"GHSA-wvp2-9ppw-337j","title":"Paths contain matrix variables bypass decorators","description":"### Impact\nSpring supports [Matrix variables](https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html).\nWhen Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path\nthat may contain matrix variables.\nIn this situation, the Armeria decorators might not invoked because of the matrix variables.\nLet's see the following example:\n```\n// Spring controller\n@GetMapping(\"/important/resources\")\npublic String important() {...}\n\n// Armeria decorator\nServerBuilder sb = ...\nsb.decoratorUnder(\"/important/\", authService);\n```\nIf an attacker sends a request with `/important;a=b/resources`, the request would bypass the authrorizer\n\n### Patches\n- https://github.com/line/armeria-ghsa-wvp2-9ppw-337j/commit/9b0ec3e099cc05fbff11d7f1012a1dddb0000d0c\n\n### Workarounds\nUsers can add decorators using regex. `e.g. \"regex:^/important.*\"`\n","status":"published","published":"2023-07-25T18:24:39Z","modified":"2023-11-05T05:00:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2023-38493","description":"Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.","status":"published","published":"2023-07-25T21:15:10.913Z","modified":"2026-06-17T06:10:20.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:18.687088Z"}],"osv":[{"id":"CVE-2023-38493","title":"Paths contain matrix variables bypass decorators","description":"Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.","status":"published","published":"2023-07-25T20:51:11.17Z","modified":"2026-10-28T10:38:53.067067552Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"GHSA-wvp2-9ppw-337j","title":"Paths contain matrix variables bypass decorators","description":"### Impact\nSpring supports [Matrix variables](https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html).\nWhen Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path\nthat may contain matrix variables.\nIn this situation, the Armeria decorators might not invoked because of the matrix variables.\nLet's see the following example:\n```\n// Spring controller\n@GetMapping(\"/important/resources\")\npublic String important() {...}\n\n// Armeria decorator\nServerBuilder sb = ...\nsb.decoratorUnder(\"/important/\", authService);\n```\nIf an attacker sends a request with `/important;a=b/resources`, the request would bypass the authrorizer\n\n### Patches\n- https://github.com/line/armeria-ghsa-wvp2-9ppw-337j/commit/9b0ec3e099cc05fbff11d7f1012a1dddb0000d0c\n\n### Workarounds\nUsers can add decorators using regex. `e.g. \"regex:^/important.*\"`\n","status":"published","published":"2023-07-25T18:24:39Z","modified":"2026-09-10T03:49:57.293851875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-38493","title":"CVE-2023-38493 in com.linecorp.armeria:armeria - Patched by Root","description":"Root has patched CVE-2023-38493 in the com.linecorp.armeria:armeria package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-01T13:44:05Z","modified":"2026-10-01T14:15:04.702568478Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}