← Vulnerability feed

Vulnerability record · CVE-2023-4853 · published 20 September 2023

CVE-2023-4853: Quarkus incorrect authorization vulnerability

Quarkus · Quarkus

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

8.1 CVSS 3.1 High EPSS 1.4% · top 27.7% CWE-148 · CWE-148CWE-863 · Incorrect authorization
8.1CVSS 3.1 base score
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
12Affected product versions listed by NVD
24References, 2 tagged exploit
4 Aug 2026Last modified by NVD

Description

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

12 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 MitigationVendor Advisory
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 ExploitMitigationTechnical DescriptionVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue TrackingVendor Advisory
https://access.redhat.com/errata/RHSA-2023:5170 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5310 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5337 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5446 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5479 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5480 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6107 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6112 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7653 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4853 MitigationVendor Advisory
https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 ExploitMitigationTechnical DescriptionVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238034 Issue TrackingVendor Advisory

Track CVE-2023-4853 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed9.8CVE-2023-6267Quarkus vulnerabilityA flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is …EPSS 0.72%9.8CVE-2022-4116Redhat build of quarkus vulnerabilityA vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to…EPSS 33%9.8CVE-2022-2466Quarkus http request smuggling vulnerabilityIt was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.EPSS 1.9%9.8CVE-2022-21724Postgresql jdbc driver vulnerabilitypgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The…EPSS 3.1%9.8CVE-2019-14892Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a mal…EPSS 5.6%9.8CVE-2018-19360Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms c…EPSS 11%9.8CVE-2018-19361Fasterxml jackson-databind deserialization of untrusted data vulnerabilityFasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from po…EPSS 11%

Source: NIST National Vulnerability Database (record CVE-2023-4853), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.