CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
An unauthenticated attacker can bypass authorization checks via path normalization discrepancies to access protected endpoints and sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87743?
CVE-2026-87743 is a high-severity authentication bypass vulnerability in Red Hat Exploit Intelligence, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
Weakness: CWE-551
Which versions are affected by CVE-2026-87743?
How do I fix CVE-2026-87743?
No fix has been published for CVE-2026-87743 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-87743 being exploited?
There is no known exploitation of CVE-2026-87743 in the wild and no public exploit code.
Sources
Also known as GHSA-pw2v-hfg7-72m6.