CVE-2026-87743

Executive Summary

CVE-2026-87743 is an authorization bypass vulnerability in the Quarkus HTTP security layer, caused by a path-normalization discrepancy (CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization) between the component that decides whether a path is public (the security matcher) and the component that actually dispatches/routes the request to an endpoint. An unauthenticated, remote attacker can craft a URL that the security matcher classifies as a public/unprotected path, but which the request dispatcher then canonicalizes and routes to a protected endpoint — yielding unauthorized access to sensitive data. The vulnerability is rated CVSS 7.5 (High) with a fully unauthenticated, network-reachable attack path and high confidentiality impact.

Technical Analysis

The root cause is an ordering/consistency defect in URL handling: authorization decisions are made on one representation of the path, while request routing operates on a different (later-derived) representation of the same path. This is classified as CWE-551, "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization."

Mechanism:

1. An HTTP request arrives with a crafted path.
2. The security matcher evaluates the path against its configured public-path rules (for example, static resources or explicitly permit-listed prefixes). At this stage, the attacker-supplied string is compared in a form that matches a public rule.
3. The request is then handed to the HTTP request dispatcher (routing layer), which performs its own normalization/canonicalization of the path — resolving path segments, deduplication of slashes, handling of encoded characters, etc.
4. Because the two components disagree on the canonical form of the path, the dispatcher routes the request to a protected endpoint that the security matcher never evaluated.

The net effect is a classic "authorization on the wrong string" bug: the access-control decision and the resource-routing decision are applied to mismatched path representations, enabling a bypass without any credentials.

Attack surface: any Quarkus application exposing HTTP endpoints where public resources and protected endpoints are distinguished by path. No authentication is required (PR:N), no user interaction is required (UI:N), and the attack is network-reachable (AV:N). Exploitation is deterministic (AC:L) once the path discrepancy is understood.

Note on scope: The NVD description does not enumerate specific matcher class names, path-normalization rules, encoding forms, or endpoint patterns. Those implementation details are therefore not asserted here. Affected version ranges were not published in the source data, so operators must treat all deployments relying on Quarkus path-based security matching as potentially exposed until a fixed release is identified.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies a Quarkus-hosted application (observable via response headers, error pages, static asset paths, or technology fingerprinting). They enumerate which paths are public (e.g., static resources, health/status endpoints) versus which paths appear protected (return 401/403).

2. Triggering the path-normalization discrepancy. The attacker crafts a URL whose raw form satisfies a public-path rule when evaluated by the security matcher, but which the dispatcher canonicalizes into the path of a protected endpoint. The precise encoding/segmentation technique depends on the specific normalization divergence in the target build; the vulnerability class permits variants involving alternative path representations and encoding of path segments. Because a working path string is not published, this step is iterative probing against the target.

3. Payload / Execution. The crafted request is submitted unauthenticated. If the matcher's public-rule evaluation accepts the path, the request proceeds to the dispatcher, which routes it to the protected handler despite the absence of authorization. No malicious payload content is required beyond the crafted path itself — the "payload" is the URL.

4. Post-Exploitation Impact. The attacker reaches protected endpoints (or data behind them) that they should not be able to access. Given CVSS confidentiality impact C:H, this can expose sensitive information returned by protected handlers. With only C:H/I:N/A:N, the described impact is unauthorized data disclosure rather than data modification or denial of service, though any state-changing protected endpoints reachable via the same bypass would also be reachable.

Impact Assessment

• Business impact: Unauthorized disclosure of data served by endpoints administrators believed were access-controlled. This can include application data, internal APIs, or administrative surfaces depending on what the protected routing table exposes.
• CVSS subscores (7.5 High): AV:N (network exploitable), AC:L (no special conditions), PR:N (no authentication), UI:N (no user interaction), S:U (impact confined to the vulnerable component), C:H (high confidentiality impact), I:N (no integrity impact per vector), A:N (no availability impact per vector).
• Blast radius: Any Quarkus application using path-based security matching to separate public and protected resources may be affected. Because it is fully unauthenticated and requires no interaction, exposure is limited only by network reachability of the application.
• EPSS: Not yet scored by FIRST.org — no probability estimate is available. CISA KEV: not listed.

Detection Guidance

Sigma Rule

title: Quarkus HTTP Path Normalization Authorization Bypass Attempt (CVE-2026-87743)
id: 2f6a1c9e-87743-4b21-9d3e-cve202687743
status: experimental
description: Detects requests with suspicious path encodings/segmentation likely probing a path-normalization mismatch between Quarkus security matcher and HTTP dispatcher.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87743
author: valtersit.com Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_paths:
    cs-uri-stem|contains:
      - '..;/'
      - '%2e%2e'
      - '%2f'
      - '//'
      - ';/'
      - '%252e'
  selection_status:
    sc-status:
      - 200
      - 301
      - 302
  condition: selection_paths and selection_status
falsepositives:
  - Legitimate clients sending encoded or repeated path separators
  - Misconfigured reverse proxies that normalize paths
level: medium
tags:
  - attack.t1190
  - cve.2026.87743

YARA Rule

rule CVE_2026_87743_Quarkus_Path_Bypass_Probe
{
    meta:
        description = "Detects crafted HTTP request lines abusing path normalization to bypass Quarkus security matcher (CVE-2026-87743)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87743"
        date = "2026-01-01"
        severity = "high"

    strings:
        $req = "GET " ascii nocase
        $req2 = "POST " ascii nocase
        $p1 = "..;/" ascii
        $p2 = "%2e%2e" ascii nocase
        $p3 = "%2f" ascii nocase
        $p4 = "//" ascii
        $p5 = "%252e" ascii nocase
        $q = "HTTP/1." ascii

    condition:
        (uint16(0) == 0x4720 or uint16(0) == 0x5020) and
        ($req or $req2) and $q and any of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87743 Quarkus HTTP path normalization authorization bypass attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(%2e%2e|%2f|\.\.;|\/\/|%252e)/i"; classtype:attempted-admin; reference:cve,2026-87743; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87743; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202687743; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and
     url.path regex~ ".*(%2e%2e|%2f|\.\.;|//|%252e).*" and
     http.request.method in ("GET","POST","PUT","DELETE")]
  [http where http.response.status_code in (200, 301, 302) and
     url.path regex~ ".*(admin|internal|api|private|secure).*"]

Splunk SPL Query

index=weblogs (cs_uri_stem="*%2e%2e*" OR cs_uri_stem="*%2f*" OR cs_uri_stem="*..;*" OR cs_uri_stem="*//*" OR cs_uri_stem="*%252e*")
| eval suspect=if(match(cs_uri_stem,"(?i)(%2e%2e|%2f|\.\.;|//|%252e)"),1,0)
| where suspect=1 AND sc_status IN (200,301,302)
| stats count values(cs_uri_stem) as paths by src_ip, cs_method
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,quarkus,cve-2026-87743,">
  <rule id="877431" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>%2e%2e|%2f|\.\.;|//|%252e</url>
    <description>CVE-2026-87743: Possible Quarkus HTTP path normalization authorization bypass attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="877432" level="12">
    <if_sid>877431</if_sid>
    <id>^(200|301|302)$</id>
    <description>CVE-2026-87743: Path bypass probe returned success status (potential authorization bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor fix available):

   • Enforce strict, single-pass path normalization at the perimeter (reverse proxy / API gateway / WAF) so that only one canonical path form reaches Quarkus. Reject or normalize requests containing encoded separators (%2e, %2f), duplicated slashes, semicolon-path parameters, or dot-segments before they reach the application.
   • Where the application architecture allows, move access control enforcement to a layer that evaluates the canonicalized path (e.g., a gateway that authorizes after normalization), rather than relying solely on Quarkus path matching.
   • Apply defense-in-depth on sensitive endpoints: require authentication on the endpoint handler itself, not only via path-based matchers, so a matcher bypass does not translate into unauthenticated access.
   • Monitor for the encoded-path patterns listed in the Detection Guidance section.

2. Patch / upgrade steps: No vendor fix, patched version, workaround, or affected-version range has been published in any tracked source. Operators must monitor the Quarkus security advisories and the NVD entry for CVE-2026-87743 and apply the official fix as soon as it is released. Because the affected range is unknown, treat all Quarkus releases using path-based security matching as potentially impacted.

3. Long-term hardening:

   • Adopt a single canonicalization routine shared by both the security matcher and the dispatcher; ensure authorization always runs on the canonical path.
   • Add regression tests that compare matcher decisions and dispatcher routing across encoded, duplicated, and dot-segment path variants.
   • Enforce endpoint-level authorization as a secondary control behind path matchers.
   • Deploy the Sigma/YARA/Suricata/Wazuh detections to detect probing of path-normalization discrepancies.

References

1. NVD — CVE-2026-87743: https://nvd.nist.gov/vuln/detail/CVE-2026-87743
2. MITRE CWE-551 — Incorrect Behavior Order: Authorization Before Parsing and Canonicalization: https://cwe.mitre.org/data/definitions/551.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Quarkus Security documentation / advisories (monitor for the CVE-2026-87743 fix): https://quarkus.io/security/
5. FIRST EPSS — CVE-2026-87743 (no score available at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-87743

Note: No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-87743 at time of writing. CVE-2026-87743 is not listed in CISA KEV, and no known threat-actor campaign has been associated with it. Vendor/product and affected versions were not provided in the source intelligence data; classification as "Quarkus" is derived from the NVD description text. All detection rules above target the vulnerability class (path-normalization bypass probing) and should be tuned against the environment's baseline before production use.