https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 11:16:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-81829 <p><strong>Affected:</strong> Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2, Red Hat Exploit Intelligence, Red Hat build of Apicurio Registry 3, Red Hat build of Quarkus, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack</p> <p>A flaw was found in SmallRye JWT&#39;s AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.</p> <p><strong>Affected:</strong> Red Hat build of Quarkus 3.27.5.SP2, Red Hat build of Quarkus 3.33.3.SP2, Red Hat Exploit Intelligence, Red Hat build of Apicurio Registry 3, Red Hat build of Quarkus, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack</p> <p>A flaw was found in SmallRye JWT&#39;s AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place.</p> https://vulnerability.circl.lu/vuln/cve-2026-81829