---
id: CVE-2023-6267
title: >-
  Quarkus: json payload getting processed prior to security checks when rest
  resources  are used with annotations.
summary: >-
  A flaw was found in the json payload. If annotation based security is used to
  secure a REST resource, the JSON body that the resource may consume is being
  processed (deserialized) prior to the security constraints being evaluated and
  app…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-755
vendor: Red Hat
product: io.quarkus/quarkus-resteasy
affected:
  - io.quarkus/quarkus-resteasy (all versions)
  - io.quarkus/quarkus-resteasy (all versions)
  - quarkus-resteasy-reactive (all versions)
  - resteasy
  - resteasy-core (all versions)
  - quarkus-resteasy-reactive
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-01-31T22:19:31.058336Z'
published: '2024-01-25'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:06:48.089Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-6267'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:0494'
    label: 'RHSA-2024:0494'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0495'
    label: 'RHSA-2024:0495'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-6267'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2251155'
    label: RHBZ#2251155
tags:
  - cve.org
epss: 0.00719
epssPercentile: 0.54017
ingestedAt: '2026-11-05T21:36:00.594Z'
---

## Overview

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

## Affected

- `io.quarkus/quarkus-resteasy (all versions)`
- `io.quarkus/quarkus-resteasy (all versions)`
- `quarkus-resteasy-reactive (all versions)`
- `resteasy`
- `resteasy-core (all versions)`
- `quarkus-resteasy-reactive`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.