Quarkus: http security policy bypass

CVE-2023-4853

Summary

A vulnerability in Quarkus has been identified where HTTP security policies fail to correctly sanitize certain character permutations in incoming requests. This flaw may lead to the incorrect evaluation of permissions, enabling an attacker to circumvent the security policy. Such exploitation could allow unauthorized access to sensitive endpoints and potentially trigger a denial of service.

References