Skip to content
Fencer Vulns
high 8.1

CVE-2023-4853 json

Quarkus: http security policy bypass

published 2023-09-20 3 y ago modified 2026-11-04 4 d ago also GHSA-4f4r-wgv2-jjvg , EUVD-2023-2416

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Patch / fix

  • maven io.quarkus:quarkus-vertx-http 2.16.11.Final, 3.2.6.Final, 3.3.3
  • maven io.quarkus:quarkus-undertow 2.16.11.Final, 3.2.6.Final, 3.3.3
  • maven io.quarkus:quarkus-csrf-reactive 2.16.11.Final, 3.2.6.Final, 3.3.3
  • maven io.quarkus:quarkus-keycloak-authorization 2.16.11.Final, 3.2.6.Final, 3.3.3
  • Red Hat Openshift Serverless 1 on RHEL 8 0:1.9.2-3.el8
  • Red Hat Red Hat build of Quarkus 2.13.8.SP2 2.13.8.Final-redhat-00005
  • Red Hat Red Hat OpenShift Serverless 1.30 1.9.2-3, 1.30.0-5, 1.30.0-6, 1.30.1-1
  • Red Hat RHEL-8 based Middleware Containers 7.13.4-2, 7.13.4-3
  • openshift-serverless-clients serverless 1.0 1.9.2-3.el8

red hat advisories RHSA-2023:5479

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-4853 updated cvss 8.1

quarkus: HTTP security policy bypass

  • Red Hat build of Quarkus quarkus-undertow, quarkus-keycloak-authorization Red Hat Integration Camel Quarkus 2 quarkus-vertx-http
    affected: workaround, no fix available
  • Red Hat Process Automation 7 quarkus-vertx-http
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rhpam-7/rhpam-kogito-builder-rhel8 7.13.4-3, rhpam-7/rhpam-kogito-rhel8-operator 7.13.4-2, rhpam-7/rhpam-kogito-runtime-jvm-rhel8 7.13.4-3, rhpam-7/rhpam-kogito-rhel8-operator-bundle 7.13.4-2, rhpam-7-tech-preview/rhpam-kogito-runtime-native-rhel8 7.13.4-3
    fixed: vendor fix RHSA-2023:6107
  • Red Hat build of OptaPlanner 8
    fixed: vendor fix RHSA-2023:5446
  • Red Hat build of Quarkus 2.13.8.SP2 quarkus-undertow 2.13.8.Final-redhat-00005, quarkus-vertx-http 2.13.8.Final-redhat-00005, quarkus-keycloak-authorization 2.13.8.Final-redhat-00005
    fixed: vendor fix RHSA-2023:5170
  • Red Hat Camel Extensions for Quarkus 2.13.3-1
    fixed: vendor fix RHSA-2023:5310
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.9.2-3.el8
    fixed: vendor fix RHSA-2023:5479
  • Red Hat OpenShift Serverless 1.30 openshift-serverless-1/client-kn-rhel8 1.9.2-3, openshift-serverless-1/kn-cli-artifacts-rhel8 1.9.2-3, openshift-serverless-1/ingress-rhel8-operator 1.30.1-1, openshift-serverless-1/knative-rhel8-operator 1.30.1-1, openshift-serverless-1/svls-must-gather-rhel8 1.30.1-1, openshift-serverless-1/serverless-rhel8-operator 1.30.1-1, +4 more
    fixed: vendor fix RHSA-2023:5480
show 4 more
  • Red Hat RHINT Camel-K-1.10.2
    fixed: vendor fix RHSA-2023:5337
  • Red Hat RHINT Service Registry 2.5.4 GA
    fixed: vendor fix RHSA-2023:7653
  • Red Hat RHPAM 7.13.4 async
    fixed: vendor fix RHSA-2023:6112
  • Red Hat build of Quarkus 2.13.8.SP2 jna 5.8.0, bson 4.7.2, db2 1.17.3, h2 2.1.214, jansi 1.18, jdom 1.1.3, +870 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.28% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • access.redhat.com https://access.redhat.com/security/vulnerabilities/RHSB-2023-002 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven io.quarkus:quarkus-vertx-http
<2.16.11.Final
>=3.0.0, <3.2.6.Final
>=3.3.0, <3.3.3
2.16.11.Final
3.2.6.Final
3.3.3
maven io.quarkus:quarkus-undertow
<2.16.11.Final
>=3.0.0, <3.2.6.Final
>=3.3.0, <3.3.3
2.16.11.Final
3.2.6.Final
3.3.3
maven io.quarkus:quarkus-csrf-reactive
<2.16.11.Final
>=3.0.0, <3.2.6.Final
>=3.3.0, <3.3.3
2.16.11.Final
3.2.6.Final
3.3.3
maven io.quarkus:quarkus-keycloak-authorization
<2.16.11.Final
>=3.0.0, <3.2.6.Final
>=3.3.0, <3.3.3
2.16.11.Final
3.2.6.Final
3.3.3

Affected products

  • Red Hat Openshift Serverless 1 on RHEL 8
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat build of Quarkus 2.13.8.SP2
  • Red Hat Red Hat Camel Extensions for Quarkus 2.13.3-1
  • Red Hat Red Hat OpenShift Serverless 1.30
  • Red Hat RHEL-8 based Middleware Containers
  • Red Hat RHINT Camel-K-1.10.2
  • Red Hat RHINT Service Registry 2.5.4 GA
  • Red Hat RHPAM 7.13.4 async
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Integration Camel Quarkus 2
  • Red Hat Red Hat Process Automation 7

Classification

Weakness
  • CWE-148 Improper Neutralization of Input Leaders
  • CWE-863 Incorrect Authorization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.