CVE-2026-87743 Red Hat CVE debrief

Who should care

Defenders and security teams responsible for Quarkus deployments should assess exposure and prioritize patching to prevent potential security breaches. This includes reviewing and updating security configurations, monitoring for unauthorized access attempts, and verifying affected versions. Security teams should also track exceptions and retest remediated assets to ensure the vulnerability is fully remediated.

Why it matters

CVE-2026-87743 is a high-severity vulnerability in Quarkus HTTP security that allows an unauthenticated attacker to bypass authorization checks. Defenders should prioritize verifying and patching affected deployments to prevent potential security breaches.

• Potential unauthorized access to sensitive information
• Bypass of security checks and access controls
• Need for verification of affected versions and remediation
• Priority for patching and updating Quarkus deployments

Technical summary

The vulnerability allows an unauthenticated attacker to craft a URL that bypasses security checks and accesses protected endpoints, potentially leading to unauthorized access to sensitive information. This is due to discrepancies in path normalization between the security matcher and HTTP request dispatchers in Quarkus HTTP security. Affected deployments should be verified and patched to prevent potential security breaches. The vulnerability has a high severity score and requires immediate attention from defenders.

Defensive priority

Defenders should prioritize verifying and patching affected Quarkus deployments to prevent potential unauthorized access.

Recommended defensive actions

• Verify and apply patches for Quarkus HTTP security
• Review and update security configurations for affected deployments
• Monitor for potential unauthorized access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to determine affected versions and remediation. The vulnerability allows an unauthenticated attacker to craft a URL that bypasses security checks and accesses protected endpoints. Source confidence is limited, and defenders should verify affected deployments and apply patches. Evidence from official sources indicates a high severity vulnerability that requires immediate attention.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.