CVE-2023-0044: Quarkus

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.

Affected products

• Quarkus Quarkus: before 2.13.7 (fixed in 2.13.7)
• Red Hat Build Of Quarkus: affected versions not specified

Published 2023-02-23. Last modified 2026-06-17.