PatchTheCVECVE-2023-6394: A flaw was found in Quarkus
CVE-2023-6394 is a high-severity flaw (CVSS 7.4) affecting quarkus, build of quarkus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an attacker to access information and functionality outside of normal granted API permissions.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.4 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 43%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2023-12-09 |
| Last modified | 2026-10-20 |
Last updated 2026-10-20 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-6394?
quarkus: upgrade to 3.6.0; build of quarkus: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2023-6394 being exploited?
CVE-2023-6394 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-6394 affect?
CVE-2023-6394 affects quarkus, build of quarkus. Severity is high (CVSS 7.4). A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured
How urgent is CVE-2023-6394?
Priority 50/100. High severity; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2026-50559 HIGH 7.5 UPGRADE Quarkus is a Java framework for building cloud-native applications
- CVE-2021-43797 MEDIUM 6.5 UPGRADE UPGRADE Netty is an asynchronous event-driven network application framework for rapid development of maintainable high
- CVE-2021-37136 HIGH 7.5 UPGRADE UPGRADE The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output da
- CVE-2021-29429 MEDIUM 4.0 UPGRADE UPGRADE In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow
- CVE-2021-29428 HIGH 8.8 UPGRADE UPGRADE In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open pe