Armeria inconsistent path normalization bypasses access controls
Java web service tool lets anyone open locked pages.
Summary
Inconsistent request path normalization in Armeria lets unauthenticated attackers bypass path-based access controls and reach protected resources. Versions prior to 1.43.0 are affected.
Affected when
- path-based access control in use
What to do
Update to Armeria 1.43.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen