CVE-2023-4853

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2023
Source publication: Sep 20, 2023
Source updated: Aug 4, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Quarkus: http security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Openshift Serverless 1 on RHEL 8

Vendor: Red Hat
Product: Openshift Serverless 1 on RHEL 8
Platforms: Unknown
Default status: affected
Package: openshift-serverless-clients
Package collection: https://access.redhat.com/downloads/content/package-browser/

Openshift Serverless 1 on RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.9.2-3.el8	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of OptaPlanner 8

Vendor: Red Hat
Product: Red Hat build of OptaPlanner 8
Platforms: Unknown
Default status: unaffected
Package: quarkus-vertx-http
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus 2.13.8.SP2

Vendor: Red Hat
Product: Red Hat build of Quarkus 2.13.8.SP2
Platforms: Unknown
Default status: affected
Package: io.quarkus/quarkus-keycloak-authorization
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat build of Quarkus 2.13.8.SP2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.13.8.Final-redhat-00005	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Quarkus 2.13.8.SP2

Vendor: Red Hat
Product: Red Hat build of Quarkus 2.13.8.SP2
Platforms: Unknown
Default status: affected
Package: io.quarkus/quarkus-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat build of Quarkus 2.13.8.SP2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.13.8.Final-redhat-00005	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Quarkus 2.13.8.SP2

Vendor: Red Hat
Product: Red Hat build of Quarkus 2.13.8.SP2
Platforms: Unknown
Default status: affected
Package: io.quarkus/quarkus-vertx-http
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat build of Quarkus 2.13.8.SP2 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.13.8.Final-redhat-00005	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Camel Extensions for Quarkus 2.13.3-1

Vendor: Red Hat
Product: Red Hat Camel Extensions for Quarkus 2.13.3-1
Platforms: Unknown
Default status: unaffected
Package: quarkus-vertx-http
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/client-kn-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.9.2-3	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/ingress-rhel8-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.1-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/knative-rhel8-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.1-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/kn-cli-artifacts-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.9.2-3	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/serverless-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.1-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/serverless-rhel8-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.1-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1/svls-must-gather-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.1-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.0-5	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1-tech-preview/logic-swf-builder-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.0-6	`unaffected`	rpm	*	Unavailable	None listed

Red Hat OpenShift Serverless 1.30

Vendor: Red Hat
Product: Red Hat OpenShift Serverless 1.30
Platforms: Unknown
Default status: affected
Package: openshift-serverless-1-tech-preview/logic-swf-devmode-rhel8
Package collection: https://catalog.redhat.com/software/containers/

Red Hat OpenShift Serverless 1.30 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.30.0-6	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rhpam-7/rhpam-kogito-builder-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.13.4-3	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rhpam-7/rhpam-kogito-rhel8-operator
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.13.4-2	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rhpam-7/rhpam-kogito-rhel8-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.13.4-2	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rhpam-7/rhpam-kogito-runtime-jvm-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.13.4-3	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rhpam-7-tech-preview/rhpam-kogito-runtime-native-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.13.4-3	`unaffected`	rpm	*	Unavailable	None listed

RHINT Camel-K-1.10.2

Vendor: Red Hat
Product: RHINT Camel-K-1.10.2
Platforms: Unknown
Default status: unaffected
Package: quarkus-vertx-http
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.

RHINT Service Registry 2.5.4 GA

Vendor: Red Hat
Product: RHINT Service Registry 2.5.4 GA
Platforms: Unknown
Default status: unaffected
Package: quarkus-vertx-http
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

RHPAM 7.13.4 async

Vendor: Red Hat
Product: RHPAM 7.13.4 async
Platforms: Unknown
Default status: unaffected
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus

Vendor: Red Hat
Product: Red Hat build of Quarkus
Platforms: Unknown
Default status: affected
Package: quarkus-keycloak-authorization
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Quarkus

Vendor: Red Hat
Product: Red Hat build of Quarkus
Platforms: Unknown
Default status: affected
Package: quarkus-undertow
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Process Automation 7

Vendor: Red Hat
Product: Red Hat Process Automation 7
Platforms: Unknown
Default status: affected
Package: quarkus-vertx-http
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.