{"id":"CVE-2023-4853","aliases":["EUVD-2023-2416","GHSA-4f4r-wgv2-jjvg","RHSA-2023:5479"],"status":"published","title":"Quarkus: http security policy bypass","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02276,"percentile":0.83226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-148","CWE-863"],"published":"2023-09-20T09:47:32Z","modified":"2026-11-04T20:54:35Z","fixes":[{"ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","fixed_in":["2.16.11.Final","3.2.6.Final","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","fixed_in":["2.16.11.Final","3.2.6.Final","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","fixed_in":["2.16.11.Final","3.2.6.Final","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","fixed_in":["2.16.11.Final","3.2.6.Final","3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","fixed_in":["0:1.9.2-3.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.24.0","0.25.0","0.26.0","0.26.1","0.27.0","0.28.0","0.28.1","1.0.0.CR1","1.0.0.CR2","1.0.0.Final","1.0.1.Final","1.1.0.CR1","1.1.0.Final","1.1.1.Final","1.10.0.CR1","1.10.0.Final","1.10.1.Final","1.10.2.Final","1.10.3.Final","1.10.4.Final","1.10.5.Final","1.11.0.Beta1","1.11.0.Beta2","1.11.0.CR1","1.11.0.Final","1.11.1.Final","1.11.2.Final","1.11.3.Final","1.11.4.Final","1.11.5.Final","1.11.6.Final","1.11.7.Final","1.12.0.CR1","1.12.0.Final","1.12.1.Final","1.12.2.Final","1.13.0.CR1","1.13.0.Final","1.13.1.Final","1.13.2.Final","1.13.3.Final","1.13.4.Final","1.13.5.Final","1.13.6.Final","1.13.7.Final","1.2.0.CR1","1.2.0.Final","1.2.1.Final","1.3.0.Alpha1","1.3.0.Alpha2","1.3.0.CR1","1.3.0.CR2","1.3.0.Final","1.3.1.Final","1.3.2.Final","1.3.3.Final","1.3.4.Final","1.4.0.CR1","1.4.0.Final","1.4.1.Final","1.4.2.Final","1.5.0.CR1","1.5.0.Final","1.5.1.Final","1.5.2.Final","1.6.0.CR1","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.CR2","1.7.0.Final","1.7.1.Final","1.7.2.Final","1.7.3.Final","1.7.4.Final","1.7.5.Final","1.7.6.Final","1.8.0.CR1","1.8.0.Final","1.8.1.Final","1.8.2.Final","1.8.3.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","2.0.0.Alpha1","2.0.0.Alpha2","2.0.0.Alpha3","2.0.0.CR1","2.0.0.CR2","2.0.0.CR3","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.CR1","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.10.0.CR1","2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final","2.10.4.Final","2.11.0.CR1","2.11.0.Final","2.11.1.Final","2.11.2.Final","2.11.3.Final","2.12.0.CR1","2.12.0.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.3.0.CR1","2.3.0.Final","2.3.1.Final","2.4.0.CR1","2.4.0.Final","2.4.1.Final","2.4.2.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.2.Final","2.5.3.Final","2.5.4.Final","2.6.0.CR1","2.6.0.Final","2.6.1.Final","2.6.2.Final","2.6.3.Final","2.7.0.CR1","2.7.0.Final","2.7.1.Final","2.7.2.Final","2.7.3.Final","2.7.4.Final","2.7.5.Final","2.7.6.Final","2.7.7.Final","2.8.0.CR1","2.8.0.Final","2.8.1.Final","2.8.2.Final","2.8.3.Final","2.9.0.CR1","2.9.0.Final","2.9.1.Final","2.9.2.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}],"versions":["3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.1.0.CR1","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}],"versions":["0.11.0","0.12.0","0.13.0","0.13.1","0.13.2","0.13.3","0.14.0","0.15.0","0.16.0","0.16.1","0.17.0","0.18.0","0.19.0","0.19.1","0.20.0","0.21.0","0.21.1","0.21.2","0.22.0","0.23.0","0.23.1","0.23.2","0.24.0","0.25.0","0.26.0","0.26.1","0.27.0","0.28.0","0.28.1","1.0.0.CR1","1.0.0.CR2","1.0.0.Final","1.0.1.Final","1.1.0.CR1","1.1.0.Final","1.1.1.Final","1.10.0.CR1","1.10.0.Final","1.10.1.Final","1.10.2.Final","1.10.3.Final","1.10.4.Final","1.10.5.Final","1.11.0.Beta1","1.11.0.Beta2","1.11.0.CR1","1.11.0.Final","1.11.1.Final","1.11.2.Final","1.11.3.Final","1.11.4.Final","1.11.5.Final","1.11.6.Final","1.11.7.Final","1.12.0.CR1","1.12.0.Final","1.12.1.Final","1.12.2.Final","1.13.0.CR1","1.13.0.Final","1.13.1.Final","1.13.2.Final","1.13.3.Final","1.13.4.Final","1.13.5.Final","1.13.6.Final","1.13.7.Final","1.2.0.CR1","1.2.0.Final","1.2.1.Final","1.3.0.Alpha1","1.3.0.Alpha2","1.3.0.CR1","1.3.0.CR2","1.3.0.Final","1.3.1.Final","1.3.2.Final","1.3.3.Final","1.3.4.Final","1.4.0.CR1","1.4.0.Final","1.4.1.Final","1.4.2.Final","1.5.0.CR1","1.5.0.Final","1.5.1.Final","1.5.2.Final","1.6.0.CR1","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.CR2","1.7.0.Final","1.7.1.Final","1.7.2.Final","1.7.3.Final","1.7.4.Final","1.7.5.Final","1.7.6.Final","1.8.0.CR1","1.8.0.Final","1.8.1.Final","1.8.2.Final","1.8.3.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","2.0.0.Alpha1","2.0.0.Alpha2","2.0.0.Alpha3","2.0.0.CR1","2.0.0.CR2","2.0.0.CR3","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.CR1","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.10.0.CR1","2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final","2.10.4.Final","2.11.0.CR1","2.11.0.Final","2.11.1.Final","2.11.2.Final","2.11.3.Final","2.12.0.CR1","2.12.0.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.3.0.CR1","2.3.0.Final","2.3.1.Final","2.4.0.CR1","2.4.0.Final","2.4.1.Final","2.4.2.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.2.Final","2.5.3.Final","2.5.4.Final","2.6.0.CR1","2.6.0.Final","2.6.1.Final","2.6.2.Final","2.6.3.Final","2.7.0.CR1","2.7.0.Final","2.7.1.Final","2.7.2.Final","2.7.3.Final","2.7.4.Final","2.7.5.Final","2.7.6.Final","2.7.7.Final","2.8.0.CR1","2.8.0.Final","2.8.1.Final","2.8.2.Final","2.8.3.Final","2.9.0.CR1","2.9.0.Final","2.9.1.Final","2.9.2.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}],"versions":["3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.1.0.CR1","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}],"versions":["2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}],"versions":["3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.1.0.CR1","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-csrf-reactive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.11.Final"}]}],"versions":["0.27.0","0.28.0","0.28.1","1.0.0.CR1","1.0.0.CR2","1.0.0.Final","1.0.1.Final","1.1.0.CR1","1.1.0.Final","1.1.1.Final","1.10.0.CR1","1.10.0.Final","1.10.1.Final","1.10.2.Final","1.10.3.Final","1.10.4.Final","1.10.5.Final","1.11.0.Beta1","1.11.0.Beta2","1.11.0.CR1","1.11.0.Final","1.11.1.Final","1.11.2.Final","1.11.3.Final","1.11.4.Final","1.11.5.Final","1.11.6.Final","1.11.7.Final","1.12.0.CR1","1.12.0.Final","1.12.1.Final","1.12.2.Final","1.13.0.CR1","1.13.0.Final","1.13.1.Final","1.13.2.Final","1.13.3.Final","1.13.4.Final","1.13.5.Final","1.13.6.Final","1.13.7.Final","1.2.0.CR1","1.2.0.Final","1.2.1.Final","1.3.0.Alpha1","1.3.0.Alpha2","1.3.0.CR1","1.3.0.CR2","1.3.0.Final","1.3.1.Final","1.3.2.Final","1.3.3.Final","1.3.4.Final","1.4.0.CR1","1.4.0.Final","1.4.1.Final","1.4.2.Final","1.5.0.CR1","1.5.0.Final","1.5.1.Final","1.5.2.Final","1.6.0.CR1","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.CR2","1.7.0.Final","1.7.1.Final","1.7.2.Final","1.7.3.Final","1.7.4.Final","1.7.5.Final","1.7.6.Final","1.8.0.CR1","1.8.0.Final","1.8.1.Final","1.8.2.Final","1.8.3.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","2.0.0.Alpha1","2.0.0.Alpha2","2.0.0.Alpha3","2.0.0.CR1","2.0.0.CR2","2.0.0.CR3","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.CR1","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.10.0.CR1","2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final","2.10.4.Final","2.11.0.CR1","2.11.0.Final","2.11.1.Final","2.11.2.Final","2.11.3.Final","2.12.0.CR1","2.12.0.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.3.0.CR1","2.3.0.Final","2.3.1.Final","2.4.0.CR1","2.4.0.Final","2.4.1.Final","2.4.2.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.2.Final","2.5.3.Final","2.5.4.Final","2.6.0.CR1","2.6.0.Final","2.6.1.Final","2.6.2.Final","2.6.3.Final","2.7.0.CR1","2.7.0.Final","2.7.1.Final","2.7.2.Final","2.7.3.Final","2.7.4.Final","2.7.5.Final","2.7.6.Final","2.7.7.Final","2.8.0.CR1","2.8.0.Final","2.8.1.Final","2.8.2.Final","2.8.3.Final","2.9.0.CR1","2.9.0.Final","2.9.1.Final","2.9.2.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.6.Final"}]}],"versions":["3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.1.0.CR1","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-keycloak-authorization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.3"}]}],"versions":["3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.2-3.el8"}]}]}],"products":[{"vendor":"quarkus","product":"quarkus"},{"vendor":"red hat","product":"openshift serverless 1 on rhel 8"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat build of quarkus"},{"vendor":"red hat","product":"red hat build of quarkus 2.13.8.sp2"},{"vendor":"red hat","product":"red hat camel extensions for quarkus 2.13.3-1"},{"vendor":"red hat","product":"red hat integration camel quarkus 2"},{"vendor":"red hat","product":"red hat openshift serverless 1.30"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"rhel-8 based middleware containers"},{"vendor":"red hat","product":"rhint camel-k-1.10.2"},{"vendor":"red hat","product":"rhint service registry 2.5.4 ga"},{"vendor":"red hat","product":"rhpam 7.13.4 async"},{"vendor":"redhat","product":"build_of_optaplanner"},{"vendor":"redhat","product":"build_of_quarkus"},{"vendor":"redhat","product":"decision_manager"},{"vendor":"redhat","product":"integration_camel_k"},{"vendor":"redhat","product":"integration_camel_quarkus"},{"vendor":"redhat","product":"integration_service_registry"},{"vendor":"redhat","product":"jboss_middleware"},{"vendor":"redhat","product":"jboss_middleware_text-only_advisories"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"redhat","product":"openshift_serverless"},{"vendor":"redhat","product":"process_automation_manager"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5170","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5310","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5337","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5446","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5479","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5480","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6107","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6112","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7653","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4853","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-002","tags":["technical-description","x_refsource_REDHAT","x_transferred","Exploit","Mitigation","Technical Description","Vendor Advisory","article","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238034","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4853","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus/issues/35785","tags":["web"]},{"url":"https://github.com/quarkusio/quarkus/discussions/35940","tags":["web"]},{"url":"https://access.redhat.com/articles/11258","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4f4r-wgv2-jjvg"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4853.json","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/serverless/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5479.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4853","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4853","title":"Quarkus: http security policy bypass","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","status":"published","published":"2023-09-20T09:47:32.15Z","modified":"2026-11-04T20:54:35.216Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-148"],"updated_at":"2026-11-04T21:42:21.553972Z"}],"euvd":[{"id":"EUVD-2023-2416","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","status":"published","published":"2023-09-20T09:47:32Z","modified":"2026-11-04T20:54:35Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T22:46:32.662412Z"}],"ghsa":[{"id":"GHSA-4f4r-wgv2-jjvg","title":"Quarkus HTTP vulnerable to incorrect evaluation of permissions","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","status":"published","published":"2023-09-20T12:30:22Z","modified":"2023-12-06T03:11:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-148","CWE-863"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2023-4853","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","status":"published","published":"2023-09-20T10:15:14.947Z","modified":"2026-11-04T21:17:23.11Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-148","CWE-863"],"updated_at":"2026-11-04T23:43:36.946093Z"}],"osv":[{"id":"CVE-2023-4853","title":"Quarkus: http security policy bypass","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","status":"published","published":"2023-09-20T09:47:32.15Z","modified":"2026-11-05T21:15:52.778817391Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-148"],"updated_at":"2026-11-05T22:01:21.792402Z"},{"id":"GHSA-4f4r-wgv2-jjvg","title":"Quarkus HTTP vulnerable to incorrect evaluation of permissions","description":"A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.","status":"published","published":"2023-09-20T12:30:22Z","modified":"2024-03-13T05:36:04.528727Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-148","CWE-863"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"RHSA-2023:5479","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.30.1 security update","status":"published","published":"2024-09-16T13:39:53Z","modified":"2026-08-05T10:15:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"}]}}