Exploit Intelligence
Monthly
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Denial of service in the Red Hat Quarkus WebSockets Next extension (quarkus-websockets-next), as shipped in Red Hat Build of Quarkus and Red Hat Enterprise Linux AI (RHEL AI) 3, allows a remote, unauthenticated attacker to crash the Java Virtual Machine by streaming WebSocket messages over a single connection faster than the application can consume them. Unbounded message buffering combined with a lack of read backpressure exhausts heap memory, producing a java.lang.OutOfMemoryError that terminates the JVM and takes the hosting service offline; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms availability-only impact with no confidentiality or integrity loss and requires no authentication, user interaction, or special configuration beyond an attacker-reachable WebSocket endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was included in the available intelligence; the practical risk is governed by exposure, since only applications serving a WebSocket route to untrusted networks are reachable.
Cross-site scripting and JSON injection in the Quarkus Qute template engine stem from the {#eval} section helper failing to pass the parent template's content type to the sub-template it evaluates, so contextual escaping is skipped and untrusted data is emitted as raw HTML or JSON. The flaw reaches Red Hat Build of Quarkus and downstream Red Hat offerings that bundle Qute (Red Hat Build of Apache Camel 4 for Quarkus 3, Red Hat Build of Keycloak, Red Hat Build of Apicurio Registry 3 and Red Hat Fuse 7), but only where an application passes attacker-influenced data into {#eval}. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1): payload submission needs no authentication (PR:N), yet a victim must render the affected page for script execution to occur, and impact is confined to that victim's browser context (C:L/I:L/A:N); no public exploit identified at time of analysis.
Quarkus HTTP security path-normalization discrepancy allows unauthenticated remote attackers to craft a URL that the security matcher treats as public while the dispatcher routes it to a protected endpoint, bypassing path-based authorization and reading sensitive data (CVSS 3.1 7.5, C:H/I:N/A:N). This affects deployments that rely on Quarkus HTTP security path-pattern policies to gate confidential endpoints; applications using only handler-level role or annotation checks are not bypassed this way. No public exploit identified at time of analysis.
Denial of service in the Red Hat Quarkus WebSockets Next extension (quarkus-websockets-next), as shipped in Red Hat Build of Quarkus and Red Hat Enterprise Linux AI (RHEL AI) 3, allows a remote, unauthenticated attacker to crash the Java Virtual Machine by streaming WebSocket messages over a single connection faster than the application can consume them. Unbounded message buffering combined with a lack of read backpressure exhausts heap memory, producing a java.lang.OutOfMemoryError that terminates the JVM and takes the hosting service offline; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms availability-only impact with no confidentiality or integrity loss and requires no authentication, user interaction, or special configuration beyond an attacker-reachable WebSocket endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was included in the available intelligence; the practical risk is governed by exposure, since only applications serving a WebSocket route to untrusted networks are reachable.
Cross-site scripting and JSON injection in the Quarkus Qute template engine stem from the {#eval} section helper failing to pass the parent template's content type to the sub-template it evaluates, so contextual escaping is skipped and untrusted data is emitted as raw HTML or JSON. The flaw reaches Red Hat Build of Quarkus and downstream Red Hat offerings that bundle Qute (Red Hat Build of Apache Camel 4 for Quarkus 3, Red Hat Build of Keycloak, Red Hat Build of Apicurio Registry 3 and Red Hat Fuse 7), but only where an application passes attacker-influenced data into {#eval}. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1): payload submission needs no authentication (PR:N), yet a victim must render the affected page for script execution to occur, and impact is confined to that victim's browser context (C:L/I:L/A:N); no public exploit identified at time of analysis.