CVE-2023-4853: A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in…

PriorityP349high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

EPSS

1.21%

65.1th percentile

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
quarkus	quarkus	< 2.16.11	2.16.11
quarkus	quarkus	>= 3.2.0 < 3.2.6	3.2.6
quarkus	quarkus	>= 3.3.0 < 3.3.3	3.3.3
redhat	build_of_optaplanner	—	—
redhat	build_of_quarkus	>= 2.13.0 < 2.13.8	2.13.8
redhat	decision_manager	—	—
redhat	integration_camel_k	< 1.10.2	1.10.2
redhat	jboss_middleware	—	—
redhat	jboss_middleware_text-only_advisories	—	—
redhat	openshift_container_platform	—	—
redhat	openshift_container_platform	—	—
redhat	openshift_container_platform	—	—
redhat	openshift_serverless	—	—
redhat	process_automation_manager	—	—

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vendor_redhat8.1HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.