Read the docs
TI-2023-02786 Aliases CVE-2023-2974GHSA-3fhx-3vvg-2j84

Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced…

Priority LOW 37CWE-757Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.

Why it matters now

EPSS 0.00882 59th percentileScored 2026-11-07
Fix Partial io.quarkus:quarkus-core (Maven): 2.16.8.FinalRed Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Quarkus 2.13.8.Final—2.13.8.Final-redhat-00004Patch availableCNA
Red HatRed Hat build of Quarkus 2.13.8.Final—2.13.8.Final-redhat-00004Patch availableCNA
—io.quarkus:quarkus-core (Maven)before 2.16.8.Final2.16.8.FinalPatch availableGHSA-3fhx-3vvg-2j84
  • Red Hat build of Quarkus 2.13.8.Final VendorRed Hat Affected — Fixed in 2.13.8.Final-redhat-00004 Patch available CNA
  • Red Hat build of Quarkus 2.13.8.Final VendorRed Hat Affected — Fixed in 2.13.8.Final-redhat-00004 Patch available CNA
  • io.quarkus:quarkus-core (Maven) Vendor— Affected before 2.16.8.Final Fixed in 2.16.8.Final Patch available GHSA-3fhx-3vvg-2j84

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:*:*:*:*before 2.13.8VulnerableRed Hat
  • cpe:2.3:a:redhat:build_of_quarkus:*:*:*:*:*:*:*:* Versions before 2.13.8 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-3fhx-3vvg-2j84 io.quarkus:quarkus-core (Maven) Fixed in 2.16.8.Final Advisory →

Red Hat 1 advisory

  • RHSA-2023:3809 Released 2023-06-29 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.13.8 release and security update
    • Red Hat build of Quarkus 2.13.8.Final com.graphql-java.graphql-java-19.4.0.redhat-00001.jar, io.quarkus.quarkus-grpc-2.13.8.Final-redhat-00004.jar, io.quarkus.quarkus-oidc-2.13.8.Final-redhat-00004.jar +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat build of QuarkusAffectedNo fix yet
Red Hat build of Quarkus 2.13.8.FinalFixed RHSA-2023:3809
Not affected: 1 product
  • Red Hat build of Quarkus 2.13.8.Final

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2974
  2. 2026-10-03 Alias added: GHSA-3fhx-3vvg-2j84

References

Advisory 4

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2023-05869 Quarkus: graphql operations over websockets bypass CVSS 3.1CRITICAL 9.1
  • TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
  • TI-2022-04106 Server-side request forgery in undertow CVSS 3.1HIGH 7.5
  • TI-2023-01048 Undertow: infinite loop in sslconduit during close CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences