Threats tagged 'ghsa-pw2v-hfg7-72m6'

A vulnerability in Quarkus HTTP security allows an unauthenticated attacker to bypass authorization by exploiting a discrepancy in path normalization between the security matcher and HTTP request dispatchers. This flaw enables crafting URLs that appear public to the security matcher but route to protected endpoints, potentially exposing sensitive information. The issue is tracked as CVE-2026-87743 with a high severity rating and a CVSS score of 7.5. Red Hat has issued an important security update in Quarkus 3.33.3.SP2 that addresses this vulnerability.