CVE-2023-4853: quarkus Improper Neutralization of Input Leaders
Vulnerability summary
CVE-2023-4853 is a high (CVSS 8.1) Improper Neutralization of Input Leaders vulnerability in quarkus. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 72.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 20-09-2023PublishedVulnerability first disclosed.
- 04-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.45%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.01 pp
From 1.44% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (access.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-148Improper Neutralization of Input LeadersThe product does not properly handle when a leading character or sequence ("leader") is missing or malformed, or if multiple leaders are used when only one should be allowed.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Redhat12 products
- build_of_optaplanner8.0
- build_of_quarkus≥ 2.13.0, < 2.13.8
- decision_manager7.0
- integration_camel_k< 1.10.2
- integration_camel_quarkusna
Io.quarkus4 products
- quarkus-csrf-reactive< 2.16.11.Final | ≥ 3.0.0, < 3.2.6.Final | ≥ 3.3.0, < 3.3.3
- quarkus-keycloak-authorization< 2.16.11.Final | ≥ 3.0.0, < 3.2.6.Final | ≥ 3.3.0, < 3.3.3
- quarkus-undertow< 2.16.11.Final | ≥ 3.0.0, < 3.2.6.Final | ≥ 3.3.0, < 3.3.3
- quarkus-vertx-http< 2.16.11.Final | ≥ 3.0.0, < 3.2.6.Final | ≥ 3.3.0, < 3.3.3
Quarkus1 product
- quarkus< 2.16.11 | ≥ 3.2.0, < 3.2.6 | ≥ 3.3.0, < 3.3.3
3 vendors · 17 products
References
24 links- access.redhat.com/security/cve/CVE-2023-4853VDB EntryX Refsource REDHATREPORTWEBMitigationVendor Advisory
Show all 24 references
- access.redhat.com/security/vulnerabilities/RHSB-2023-002Technical DescriptionX Refsource REDHATARTICLEWEBExploitMitigationVendor Advisory
- github.com/quarkusio/quarkusPACKAGE