A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This is…

High CVSS 8.1

CVECVE-2023-4853

First seen2026-08-04 19:15 UTC

Disclosed2023-09-20 10:15 UTC

Last updated2026-08-04 19:15 UTC

Channel statusauto

Summary

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 Mitigation
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue Tracking
https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 Mitigation
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue Tracking

Timeline

2026-08-04 nvd_ingest NVD