Geoand

Quarkus, a Java framework for cloud-native applications, allows the bypass of HTTP path-based authorization policies. This can be achieved by using encoded semicolons (`%3B`) to smuggle matrix parameters past the security layer, or by using encoded slashes (`%2F`) and backslashes (`%5C`) to gain unauthorized access to protected static resources.

Name of the Vulnerable Software and Affected Versions: hapi versions 15.0.0 through 16.1.0 Description: The issue occurs when hapi encounters a malformed `accept-encoding` header, which may cause it to crash or hang the client connection until the timeout period is reached. Affected versions of hapi will crash or lock the event loop when such a header is received. Recommendations: Update to version 16.1.1 or later.