Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.quarkus:quarkus-vertx-http

5 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
3.40.1.1 (Oct 19, 2026): no advisory affects it
Newest unaffected release
3.40.1.1 (Oct 19, 2026), the latest release
Advisories
5 · 4 high
Dependents
166
Releases
500 since 0.23.0 (Sep 25, 2019)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-50559
    Affects 0.23.0 to 3.20.6.1 (3.20.6.2 is outside it); 3.21.0.CR1 to 3.27.4 (3.27.4.1 is outside it); 3.28.0.CR1 to 3.33.2 (3.33.2.1 is outside it); 3.34.0.CR1 to 3.36.2 (3.36.3 is outside it); 3.37.0.CR1 (3.37.0 is outside it)
  • CVE-2026-39852
    Affects 0.23.0 to 3.20.6 (3.20.6.1 is outside it); 3.21.0 to 3.27.3 (3.27.3.1 is outside it); 3.30.0 to 3.33.1 (3.33.1.1 is outside it); 3.34.0 to 3.35.1 (3.35.2 is outside it)
  • CVE-2023-4853
    Affects 0.23.0 to 2.16.10.Final (2.16.11.Final is outside it); 3.0.0.Final to 3.2.5.Final (3.2.6.Final is outside it); 3.3.0 to 3.3.2 (3.3.3 is outside it)
  • CVE-2023-0044
    Affects 0.23.0 to 2.13.6.Final (2.13.7.Final is outside it)
  • CVE-2022-4147
    Affects 0.23.0 to 2.13.4.Final (2.13.5.Final is outside it); 2.14.0.CR1 to 2.14.1.Final (2.14.2.Final is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

    Affected: fixed in 3.20.6.2; from 3.21.0.CR1, fixed in 3.27.4.1; from 3.28.0.CR1, fixed in 3.33.2.1; from 3.34.0.CR1, fixed in 3.36.3; from 3.37.0.CR1, fixed in 3.37.0.

    Fixed in 3.20.6.2 (released Jun 17, 2026, 2 days before disclosure), 3.27.4.1 (released Jun 17, 2026, 2 days before disclosure), 3.33.2.1 (released Jun 17, 2026, 2 days before disclosure) and 2 other versions.

    The latest release, 3.40.1.1, is not affected.

  • Quarkus authorization bypass via semicolon path normalization inconsistency

    Affected: fixed in 3.20.6.1; from 3.21.0, fixed in 3.27.3.1; from 3.30.0, fixed in 3.33.1.1; from 3.34.0, fixed in 3.35.1.1.

    Fixed in 3.20.6.1 (released May 4, 2026, 1 day before disclosure), 3.27.3.1 (released May 4, 2026, 1 day before disclosure), 3.33.1.1 (released May 4, 2026, 1 day before disclosure) and 1 other version.

    The latest release, 3.40.1.1, is not affected.

  • Quarkus: http security policy bypass

    Affected: fixed in 2.16.11.Final; from 3.0.0, fixed in 3.2.6.Final; from 3.3.0, fixed in 3.3.3.

    Fixed in 2.16.11.Final (released Sep 13, 2023, 7 days before disclosure), 3.2.6.Final (released Sep 13, 2023, 7 days before disclosure) and 3.3.3 (released Sep 13, 2023, 7 days before disclosure).

    The latest release, 3.40.1.1, is not affected.

  • If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead…

    Affected: fixed in 2.13.7.Final.

    Fixed in 2.13.7.Final (released Jan 19, 2023, 35 days before disclosure).

    The latest release, 3.40.1.1, is not affected.

  • Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed.

    Affected: from 2.14.0.CR1, fixed in 2.14.2.Final; fixed in 2.13.5.Final.

    Fixed in 2.13.5.Final (released Nov 25, 2022, 11 days before disclosure) and 2.14.2.Final (released Nov 25, 2022, 11 days before disclosure).

    The latest release, 3.40.1.1, is not affected.