CVE-2026-121823 Details
Description
A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and access protected resources.
A vulnerability exists in Armeria versions prior to 1.43.0, where inconsistent normalization of request paths can enable unauthenticated attackers to bypass access controls based on path prefixes, thereby gaining access to protected resources. This issue arises because Armeria's request target normalization process rejects double dot segments but allows single dot segments, which can be exploited to evade path-scoped authorization mechanisms.
Users are advised to update Armeria to version 1.43.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v | [email protected] | AdvisoryExploitRemedyTechnical DescriptionVendor |
| https://line.github.io/security-advisory-blog/CVE-2026-121823/ | [email protected] | AdvisoryRemedy |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| LINE Armeria | < 1.43.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |