Read the docs
TI-2023-05755 Aliases CVE-2023-6267GHSA-8j3x-w35r-rw4r

Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.

Priority MEDIUM 44CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00719 54th percentileScored 2026-11-07
Fix Partial io.quarkus.resteasy.reactive:resteasy-reactive (Maven): 2.13.9.Final, 3.2.9.FinalRed Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat build of Quarkus 2.13.9.Final—2.13.9.Final-redhat-00003Patch availableCNA
Red HatRed Hat build of Quarkus 3.2.9.Final—3.2.9.Final-redhat-00003Patch availableCNA
Red HatRed Hat build of OptaPlanner 8——No fix listedCNA
Red HatRed Hat Fuse 7——Not affectedCNA
Red HatRed Hat Integration Camel K 1——No fix listedCNA
Red HatRed Hat Integration Camel Quarkus 2——Not affectedCNA
—io.quarkus.resteasy.reactive:resteasy-reactive (Maven)before 2.13.9.Final2.13.9.FinalPatch availableGHSA-8j3x-w35r-rw4r
—io.quarkus.resteasy.reactive:resteasy-reactive (Maven)3.0.0.Final to before 3.2.9.Final3.2.9.FinalPatch availableGHSA-8j3x-w35r-rw4r
  • Red Hat build of Quarkus 2.13.9.Final VendorRed Hat Affected — Fixed in 2.13.9.Final-redhat-00003 Patch available CNA
  • Red Hat build of Quarkus 3.2.9.Final VendorRed Hat Affected — Fixed in 3.2.9.Final-redhat-00003 Patch available CNA
  • Red Hat build of OptaPlanner 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Integration Camel Quarkus 2 VendorRed Hat Affected — Fixed in — Not affected CNA
  • io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Vendor— Affected before 2.13.9.Final Fixed in 2.13.9.Final Patch available GHSA-8j3x-w35r-rw4r
  • io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Vendor— Affected 3.0.0.Final to before 3.2.9.Final Fixed in 3.2.9.Final Patch available GHSA-8j3x-w35r-rw4r

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.13.9; 3.0.0 to before 3.2.9Vulnerablequarkusio
cpe:2.3:a:quarkus:quarkus:2.13.9:-:*:*:*:*:*:*2.13.9Vulnerablequarkusio
cpe:2.3:a:quarkus:quarkus:3.2.9:-:*:*:*:*:*:*3.2.9Vulnerablequarkusio
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.13.9; 3.0.0 to before 3.2.9 Vulnerable ·quarkusio
  • cpe:2.3:a:quarkus:quarkus:2.13.9:-:*:*:*:*:*:* Versions 2.13.9 Vulnerable ·quarkusio
  • cpe:2.3:a:quarkus:quarkus:3.2.9:-:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·quarkusio

Remediation

  • Fix · GHSA-8j3x-w35r-rw4r io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Fixed in 2.13.9.Final Advisory →
  • Fix · GHSA-8j3x-w35r-rw4r io.quarkus.resteasy.reactive:resteasy-reactive (Maven) Fixed in 3.2.9.Final Advisory →

Red Hat 2 advisories

  • RHSA-2024:0495 Released 2024-01-25 · Red Hat rating Important
    Red Hat build of Quarkus 3.2.9.SP1 release and security update
    • Red Hat build of Quarkus 3.2.9.Final io.quarkus.quarkus-resteasy-3.2.9.Final-redhat-00003.jar, io.quarkus.quarkus-resteasy-reactive-3.2.9.Final-redhat-00003.jar
  • RHSA-2024:0494 Released 2024-01-25 · Red Hat rating Important
    Red Hat build of Quarkus 2.13.9.SP1 release and security update
    • Red Hat build of Quarkus 2.13.9.Final io.quarkus.quarkus-resteasy-2.13.9.Final-redhat-00003.jar, io.quarkus.quarkus-resteasy-reactive-2.13.9.Final-redhat-00003.jar

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Red Hat build of Quarkus 2.13.9.FinalFixed RHSA-2024:0494
Red Hat build of Quarkus 3.2.9.FinalFixed RHSA-2024:0495
Not affected: 4 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel Quarkus 2
  • Red Hat build of Quarkus 2.13.9.Final
  • Red Hat build of Quarkus 3.2.9.Final

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6267
  2. 2026-10-03 Alias added: GHSA-8j3x-w35r-rw4r

References

Advisory 5

Other 1

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences