CVE-2023-4853High· 8.1▾ Twilight

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score45/ 100 · Moderate

impact 44.6 · likelihood 0.3 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 20, 2023

Updated

Aug 4, 2026

CVSS

8.1

Vendor

quarkus

Product

quarkus

CWE

CWE-148, CWE-863

Depth score

45 · Moderate

EPSS

1.4% · p73

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

1.2% → 1.4%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1105 days

Sep 20, 2023Published
Disclosed via NVD
Aug 4, 2026Record revised
Last analysed / modified upstream
Aug 4, 2026EPSS first tracked
1.2%
Sep 29, 2026EPSS peak
1.2% → 1.4%

quarkus CWE-148 CWE-863 #nvd

Affected

quarkus < 2.16.11
quarkus >= 3.2.0, < 3.2.6
quarkus >= 3.3.0, < 3.3.3
build_of_optaplanner = 8.0
build_of_quarkus >= 2.13.0, < 2.13.8
decision_manager = 7.0
integration_camel_k < 1.10.2
integration_camel_quarkus
integration_service_registry
jboss_middleware = 1
jboss_middleware_text-only_advisories = 1.0
openshift_serverless
openshift_serverless = 1.0
process_automation_manager = 7.0
openshift_container_platform = 4.10
openshift_container_platform = 4.11
openshift_container_platform = 4.12

Patched in

quarkus 3.3.3
build_of_quarkus 2.13.8
integration_camel_k 1.10.2

Full technical detail▾

Overview

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Affected

quarkus < 2.16.11
quarkus >= 3.2.0, < 3.2.6
quarkus >= 3.3.0, < 3.3.3
build_of_optaplanner = 8.0
build_of_quarkus >= 2.13.0, < 2.13.8
decision_manager = 7.0
integration_camel_k < 1.10.2
integration_camel_quarkus
integration_service_registry
jboss_middleware = 1
jboss_middleware_text-only_advisories = 1.0
openshift_serverless
openshift_serverless = 1.0
process_automation_manager = 7.0
openshift_container_platform = 4.10
openshift_container_platform = 4.11
openshift_container_platform = 4.12

Remediation

Upgrade past the affected range:

quarkus 3.3.3
build_of_quarkus 2.13.8
integration_camel_k 1.10.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd