# io.quarkus:quarkus-vertx-http (Maven) vulnerabilities 5 known vulnerabilities (4 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.40.1.1 (Oct 19, 2026): no advisory affects it - Newest unaffected release: 3.40.1.1 (Oct 19, 2026), the latest release - Dependents: 166 - Releases: 500 since 0.23.0 (Sep 25, 2019) - Registry: https://central.sonatype.com/artifact/io.quarkus/quarkus-vertx-http - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-50559: 0.23.0 to 3.20.6.1 (3.20.6.2 is outside it); 3.21.0.CR1 to 3.27.4 (3.27.4.1 is outside it); 3.28.0.CR1 to 3.33.2 (3.33.2.1 is outside it); 3.34.0.CR1 to 3.36.2 (3.36.3 is outside it); 3.37.0.CR1 (3.37.0 is outside it) - CVE-2026-39852: 0.23.0 to 3.20.6 (3.20.6.1 is outside it); 3.21.0 to 3.27.3 (3.27.3.1 is outside it); 3.30.0 to 3.33.1 (3.33.1.1 is outside it); 3.34.0 to 3.35.1 (3.35.2 is outside it) - CVE-2023-4853: 0.23.0 to 2.16.10.Final (2.16.11.Final is outside it); 3.0.0.Final to 3.2.5.Final (3.2.6.Final is outside it); 3.3.0 to 3.3.2 (3.3.3 is outside it) - CVE-2023-0044: 0.23.0 to 2.13.6.Final (2.13.7.Final is outside it) - CVE-2022-4147: 0.23.0 to 2.13.4.Final (2.13.5.Final is outside it); 2.14.0.CR1 to 2.14.1.Final (2.14.2.Final is outside it) ## Advisories (5) ### [CVE-2026-50559](https://cve.now/CVE-2026-50559): Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities - Severity: High 7.5 - Published: Jun 19, 2026 - Affected: fixed in 3.20.6.2; from 3.21.0.CR1, fixed in 3.27.4.1; from 3.28.0.CR1, fixed in 3.33.2.1; from 3.34.0.CR1, fixed in 3.36.3; from 3.37.0.CR1, fixed in 3.37.0. - Fixed in 3.20.6.2 (released Jun 17, 2026, 2 days before disclosure), 3.27.4.1 (released Jun 17, 2026, 2 days before disclosure), 3.33.2.1 (released Jun 17, 2026, 2 days before disclosure) and 2 other versions. - The latest release, 3.40.1.1, is not affected. ### [CVE-2026-39852](https://cve.now/CVE-2026-39852): Quarkus authorization bypass via semicolon path normalization inconsistency - Severity: High 8.8 - Published: May 5, 2026 - Affected: fixed in 3.20.6.1; from 3.21.0, fixed in 3.27.3.1; from 3.30.0, fixed in 3.33.1.1; from 3.34.0, fixed in 3.35.1.1. - Fixed in 3.20.6.1 (released May 4, 2026, 1 day before disclosure), 3.27.3.1 (released May 4, 2026, 1 day before disclosure), 3.33.1.1 (released May 4, 2026, 1 day before disclosure) and 1 other version. - The latest release, 3.40.1.1, is not affected. ### [CVE-2023-4853](https://cve.now/CVE-2023-4853): Quarkus: http security policy bypass - Severity: High 8.1 - Published: Sep 20, 2023 - Affected: fixed in 2.16.11.Final; from 3.0.0, fixed in 3.2.6.Final; from 3.3.0, fixed in 3.3.3. - Fixed in 2.16.11.Final (released Sep 13, 2023, 7 days before disclosure), 3.2.6.Final (released Sep 13, 2023, 7 days before disclosure) and 3.3.3 (released Sep 13, 2023, 7 days before disclosure). - The latest release, 3.40.1.1, is not affected. ### [CVE-2023-0044](https://cve.now/CVE-2023-0044): If the Quarkus Form Authentication session cookie Path attribute is set to \`/\` then a cross-site attack may be initiated which might lead… - Severity: Unrated - Published: Feb 23, 2023 - Affected: fixed in 2.13.7.Final. - Fixed in 2.13.7.Final (released Jan 19, 2023, 35 days before disclosure). - The latest release, 3.40.1.1, is not affected. ### [CVE-2022-4147](https://cve.now/CVE-2022-4147): Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. - Severity: High 7.5 - Published: Dec 6, 2022 - Affected: from 2.14.0.CR1, fixed in 2.14.2.Final; fixed in 2.13.5.Final. - Fixed in 2.13.5.Final (released Nov 25, 2022, 11 days before disclosure) and 2.14.2.Final (released Nov 25, 2022, 11 days before disclosure). - The latest release, 3.40.1.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/io.quarkus:quarkus-vertx-http Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.