{"id":"CVE-2023-38493","summary":"Paths contain matrix variables bypass decorators","details":"Armeria is a microservice framework Spring supports Matrix variables. When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path that may contain matrix variables. Prior to version 1.24.3, the Armeria decorators might not invoked because of the matrix variables. If an attacker sends a specially crafted request, the request may bypass the authorizer. Version 1.24.3 contains a patch for this issue.","aliases":["GHSA-wvp2-9ppw-337j"],"modified":"2026-08-12T14:51:02.948538Z","published":"2023-07-25T20:51:11.170Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38493.json"},"references":[{"type":"WEB","url":"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38493.json"},{"type":"ADVISORY","url":"https://github.com/line/armeria/security/advisories/GHSA-wvp2-9ppw-337j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38493"},{"type":"FIX","url":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/line/armeria","events":[{"introduced":"0"},{"fixed":"195e1670218caf1ec00fa0ab631486d6224b72c2"},{"fixed":"039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07"}],"database_specific":{"cpe":"cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.24.3"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["armeria-1.24.2","armeria-0.27.0.Final","armeria-0.26.1.Final","armeria-0.26.0.Final","armeria-0.25.0.Final","armeria-0.24.1.Final","armeria-0.24.0.Final","armeria-0.23.1.Final","armeria-0.23.0.Final","armeria-0.22.0.Final","armeria-0.21.6.Final","armeria-0.21.5.Final","armeria-0.21.4.Final","armeria-0.21.3.Final","armeria-0.21.2.Final","armeria-0.21.1.Final","armeria-0.21.0.Final","armeria-0.20.2.Final","armeria-0.20.1.Final","armeria-0.20.0.Final","armeria-0.19.0.Final","armeria-0.18.0.Final","armeria-0.17.0.Final","armeria-0.16.1.Final","armeria-0.16.0.Final","armeria-0.15.0.Final","armeria-0.14.0.Final","armeria-0.13.4.Final","armeria-0.13.3.Final","armeria-0.13.2.Final","armeria-0.13.1.Final","armeria-0.13.0.Final","armeria-0.12.2.Final","armeria-0.12.1.Final","armeria-0.12.0.Final","armeria-0.11.0.Final","armeria-0.10.0.Final","armeria-0.9.0.Final","armeria-0.8.0.Final","armeria-0.7.0.Final","armeria-0.6.4.Final","armeria-0.6.3.Final","armeria-0.6.2.Final","armeria-0.6.1.Final","armeria-0.6.0.Final","armeria-0.5.1.Final","armeria-0.5.0.Final","armeria-0.4.0.Final"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-38493.json","vanir_signatures_modified":"2026-08-12T14:51:02Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"tomcat10/src/main/java/com/linecorp/armeria/server/tomcat/TomcatService.java"},"deprecated":false,"digest":{"line_hashes":["271070631583665534814547464493287668384","87364658546434303573492488549593008920","159748384075096483181475890412755268388","177481108298025224234919853102407568654","303526408640804292724060922068509178646","305310882719618728422824232158616867658","305548734376056651583681413258118355610","205732225616183711231849063305835746088","91986483001747361613132503216632194794","204607078309773140774674933038797704703","259426368077687794192737306422595102339","177602742049819923504462592391711172624","308057272808916342563594876660311314723","226214431540389695618127975269033137573","182034613341699845466616372274793962674","148424355459130878808090565796916361859"],"threshold":0.9},"id":"CVE-2023-38493-02636b3d","signature_type":"Line"},{"source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"withPath"},"deprecated":false,"digest":{"function_hash":"275293701950353833925818871897265940178","length":160},"id":"CVE-2023-38493-037c89c2","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"168455087473893767521782890923900265986","length":635},"id":"CVE-2023-38493-05ac23e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"function":"AbstractRequestContextBuilder","file":"core/src/main/java/com/linecorp/armeria/common/AbstractRequestContextBuilder.java"},"deprecated":false},{"digest":{"function_hash":"195591030972623006947458033678544463239","length":371},"id":"CVE-2023-38493-05ad7c88","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/test/java/com/linecorp/armeria/internal/common/DefaultRequestTargetTest.java","function":"serverShouldHandleReservedCharacters"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["201049691336513134761176328769463923169","7861993909340891886224912009453664026","174874259023789385017062666974873373233","98943314604179378107187733141128069294","132127119844675355351228999345459346700","252489964223420657389612217322562159911","253485731269064059276167523374228079055"]},"id":"CVE-2023-38493-1c57a6b0","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/common/RequestTarget.java"}},{"digest":{"threshold":0.9,"line_hashes":["168101291770167247258255282233866640051","116879853472807017518400913639357230745","234452595284091689870433468314941589875"]},"id":"CVE-2023-38493-25d22ccb","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/common/SystemPropertyFlagsProvider.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"193638707080214817608356974293589340151","length":259},"id":"CVE-2023-38493-2b4b1179","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"spring/boot3-webflux-autoconfigure/src/main/java/com/linecorp/armeria/spring/web/reactive/ArmeriaServerHttpRequest.java","function":"uri"}},{"deprecated":false,"digest":{"function_hash":"235124606986073922779112644117462850713","length":168},"id":"CVE-2023-38493-34475176","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/ExactPathMapping.java","function":"ExactPathMapping"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"it/spring/boot3-tomcat10/src/test/java/com/linecorp/armeria/spring/tomcat/ActuatorAutoConfigurationHealthGroupTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["60095955750214426455377842728610261793","203443529961312764288456187659690122700","117740517473516700121132681684283074687","73213046580437625299052646071826393257","138804794983628688549096599358791354357"]},"id":"CVE-2023-38493-39608b64"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"createWithoutValidation"},"deprecated":false,"digest":{"function_hash":"339552414665627376668108024348858209538","length":220},"id":"CVE-2023-38493-39e5dfc9"},{"id":"CVE-2023-38493-4ed1f63b","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"spring/boot3-webflux-autoconfigure/src/main/java/com/linecorp/armeria/spring/web/reactive/ArmeriaServerHttpRequest.java"},"deprecated":false,"digest":{"line_hashes":["172032285390337014931731807246387617987","22213623849501647712544694019026794052","233912976081903559075305617269955279815","140498344605881650292821315448931406770","33545888424328199466630939624443394882","12905101138511572574104791198808381005","104418940360912200031819321070925625282","208525669030755054603098749937768598743","212150613945950183549480277865239369711","204644337548039466919213236699386472104","115616584886883329873634023121924851871","110336863665455610527369623673239732609","274273419423524862677009465348818966746","20729406879334104193193713941401127005","307708700531183895104968465094780297430","88270063821911172726821849027994580931","120570498113049833363759213664760556390"],"threshold":0.9}},{"digest":{"line_hashes":["259609796438454491967964031972270052945","119401456138484166892715242652087211649","263021624168807487745532874093401033811","173509558391987643264740602615216277021","172316316695926320903057321928432341988"],"threshold":0.9},"id":"CVE-2023-38493-50308a3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"it/spring/boot3-tomcat10/src/test/java/com/linecorp/armeria/spring/tomcat/ErrorHandlingTest.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/RoutingContext.java"},"deprecated":false,"digest":{"line_hashes":["29346368733773175486308738920680300622","198972168980338442229125511107077238460","330029186081006376500369658158601030040","209664132369595452843513650742773307611","324958955586665193287311905034605105182"],"threshold":0.9},"id":"CVE-2023-38493-583750dd"},{"source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"function":"ArmeriaServerHttpRequest","file":"spring/boot3-webflux-autoconfigure/src/main/java/com/linecorp/armeria/spring/web/reactive/ArmeriaServerHttpRequest.java"},"deprecated":false,"digest":{"length":360,"function_hash":"302949162513964644232370532750118289311"},"id":"CVE-2023-38493-6b1feb91","signature_type":"Function","signature_version":"v1"},{"target":{"file":"core/src/test/java/com/linecorp/armeria/internal/common/DefaultRequestTargetTest.java","function":"forServer"},"deprecated":false,"digest":{"function_hash":"243484876636580056660517623586906431718","length":332},"id":"CVE-2023-38493-6cf48861","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07"},{"deprecated":false,"digest":{"function_hash":"234712356843894090019319832485425538641","length":238},"id":"CVE-2023-38493-7b426802","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/test/java/com/linecorp/armeria/internal/common/DefaultRequestTargetTest.java","function":"shouldHandleSquareBracketsInPath"}},{"signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"jetty/jetty11/src/main/java/com/linecorp/armeria/server/jetty/JettyService.java","function":"fillRequest"},"deprecated":false,"digest":{"function_hash":"132329544710926827029996527470365005300","length":544},"id":"CVE-2023-38493-7da6dbad","signature_type":"Function"},{"digest":{"length":174,"function_hash":"218205559802718762140688120575489633496"},"id":"CVE-2023-38493-80c89619","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"function":"shouldReserveQuestionMark","file":"core/src/test/java/com/linecorp/armeria/internal/common/DefaultRequestTargetTest.java"},"deprecated":false},{"digest":{"function_hash":"181465037475127810151952770225440309499","length":897},"id":"CVE-2023-38493-87acd396","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"slowForServer"},"deprecated":false},{"id":"CVE-2023-38493-90e89241","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"slowForClient"},"deprecated":false,"digest":{"function_hash":"18456224020110962767969455733615311609","length":2001}},{"source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"function":"shouldNormalizeSemicolon","file":"core/src/test/java/com/linecorp/armeria/internal/common/DefaultRequestTargetTest.java"},"deprecated":false,"digest":{"function_hash":"43405110703621777837858849734415447783","length":176},"id":"CVE-2023-38493-92453f68","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"DefaultRequestTarget"},"deprecated":false,"digest":{"function_hash":"229212394155705793672112904235000448636","length":409},"id":"CVE-2023-38493-9840a7b7"},{"signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"slowAbsoluteFormForClient"},"deprecated":false,"digest":{"function_hash":"308565600401646597840517459782037251299","length":578},"id":"CVE-2023-38493-9918e78e","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["51257509789235451627639321964810120033","28649163781369450727267994468004650061","25001013373655659728964255168541103594","58699959878396036108348274641689721608","276199704212521930242369847817321839091","147749595986971491339167335740912452243","6823949659297597773956278387222678139","127222294976368411551190904797975729176"],"threshold":0.9},"id":"CVE-2023-38493-9dc4205a","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/ParameterizedPathMapping.java"}},{"source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"jetty/jetty11/src/main/java/com/linecorp/armeria/server/jetty/JettyService.java","function":"serve"},"deprecated":false,"digest":{"function_hash":"235130429138376510113798422397374697481","length":1575},"id":"CVE-2023-38493-9deb787c","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["178781102299675246773657956408728762628","106064055810618311550485414201947357928","207554431258472627558568630652643905607","210052137708109190756593841343730311845","53408375907361852319778681624349891081","60860486366900444341940916290055462138","271354345928747861442673184140911066398","91605570551147444367433229468595176206","275856052551701383096046118271967544168","303882525531157543672454887528097073384","6154406226287082781279430264340823310","57082299334573931794609143652743073281","202238774537388753482958347552031571547","125430198748097691905147015611885895102","332757110802376602808073786058260205622","310125449707469964500833670870263791523","40666436864610347543175641071146305130","122432707403009413705198036310481904409","79845698638297203976813545298147825542","145493435962367447657452060805158406907","176108391154461793857978351677080009325","329469749104837119980097130964494254706","165751375810629967756662444165569745693","84907714876013677902734068647453953175","97522446849084938998043506422913439322","109654281527417488723266938535218589005","303509039273809636210894378967951506441","218263979228025942204443103734272245136","248677050767001759251976371831082096397","70688597322810382504840920495409008386","163622931783354675471292659566913810144","175407412774982577753444515894962764915","274519035067667005929561288177633048850","84585164182720706799649505464451965122","215296221424941146462893732293469492868","127639955003354930962333780619574082421","211501133802906634379829040527263617803","295425122754040202142973264331790424491","257371384925332162882000060492851918563","287346456585737417865279544536856244601","268369615246411384424452603654294157368","57377988352995293478395990948907504754","46924775500587144848716112759965037926","177908059955208146999518983304249280314","225134673084999410752977691092356980606","290771217117084972818131200443873461475","251095762260819873431662392449565575136","45678417350538227001988799983403087995","294136251457285089706203817165108330316","44450132979734521444634290832045249357","40761685367901859222448967256043571526","306361938901096175599431839580539354571","210509786016488949497846431675546527116","255931729019132493142879890128685926435","107779328842460269733182472420619827321","201822274393981381719585408867627162307","46499418788799747852028339625684782922","59544446068191171162382838028723932958","187839811610247854099808487120179792488","230994574472709174826841209531049775466","233695409232078589091706924721750285706","24485976183227601310286625131990042036","227336139395187369396336031988330415249","83252635385067759206038353355363449848","284944210570010902199038093212148381210","36505223521635273992769377504123893982","139954747895026602123734653783028913390","46224926976675418708372975816230425222","224497603382067053960018803275460456299","203155105164678494673821322051386539539","201385181773374213492778327709381609064","272125513565945212011767939044876017759","192870409817448709702900577835185748853","165995310844526126166720073141010653452","50754854277083803686395248811479385227","191106027633301680157494017179816652180","293667833540288745314701217325916027824","239791694938332356022380483113465055127","62577591292031710890363310823147527021","196676500868430066512848763835462600562","179221183809195639585396402032744330722","65726882505083114134364335259631342036","51677022591136475893813593457754557399","52764979269362062693761773457284969988","293480782751159086952256866155853965867","48192455980212708067845599250765920252","148998470923811198884959915224205384360","237521269406937811499199506640358978600","166425899157867173534475124699476718078","140291105083438026950119896201805144454","194126126607914224201910925860957434974","210509786016488949497846431675546527116","255931729019132493142879890128685926435","31415410516226911830447220250620241640","158551992768349931349761064304962979893","17874107162317329914348639782481528411","110753156306664406122469081893262133519","263024176717284605874291359346048901094","113904686468913932947289499048210446450","274319808302629107043303998504467719748","270592077704837344213859132959015636","48192455980212708067845599250765920252","148998470923811198884959915224205384360","237521269406937811499199506640358978600","201822274393981381719585408867627162307","90044645104671353757954127419082491214","112090340359877163457408218934352782168","188247064443476819963217096408228529802","270856156164821261887959592895046073424","263024176717284605874291359346048901094","240421600666820312268590103974990579588","27117948749275947587612267127016053865","27833324295964210154263165542837074364","213077551402243280307354943694526885559","290910898098611495907989936566579917790","226311182200634696703122766318549947095","112214695498044790725409908078636665721","4461870571538422861058071355955218290","184863001665496118681888339227492626579","145025694782020118092136788237927166265","260470479967907499608790386006806760077","217811710411262518522099544163970898081","84603187964835745023878571717153853785","66554805402346932575644723599329495953","126889573855155690968489691012375945276","93277265905609191370018006579892256813","221924447724061826627882622249003928300","332547131737460209686631152166406048712","159949678791040076361523960104924748100"],"threshold":0.9},"id":"CVE-2023-38493-9e67d85f","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java"},"deprecated":false},{"source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/common/AbstractRequestContextBuilder.java"},"deprecated":false,"digest":{"line_hashes":["338227523068762397980943060269816782705","53754424597051725429658829113182113711","99376111665656093791198485888788538667","231754010395623164773802671873447253751","102522744553230894487062495248987821848","28846819813897703108304182977245216346","186118467131505692096546796947796091037","196734540464695617831180811892577055633","45788323107531783635868902006745936941","6404228824132882444944092331190420220"],"threshold":0.9},"id":"CVE-2023-38493-9fa91edc","signature_type":"Line","signature_version":"v1"},{"target":{"file":"jetty/jetty9/src/main/java/com/linecorp/armeria/server/jetty/JettyService.java"},"deprecated":false,"digest":{"line_hashes":["31905419790598314779078916902964358998","195395401402832860901058372016293524538","306129135417370661103588560366529428190","136401770539934681615553456269483300583","122586545542369401571180535506116243513","243211199332496142767970211802610858129","4817307839527521531232968227724536373","37126175015951598155690225278567840762","235101535180176685163074740342072249702","334496308430610341012602898744253238227"],"threshold":0.9},"id":"CVE-2023-38493-af8a8368","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07"},{"target":{"file":"core/src/test/java/com/linecorp/armeria/server/RouteTest.java"},"deprecated":false,"digest":{"line_hashes":["331856846499860278623483153043123214196","208752849497618978986267749801975916249","198278733131985720796834042633835763510"],"threshold":0.9},"id":"CVE-2023-38493-bc3c2be1","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07"},{"deprecated":false,"digest":{"length":344,"function_hash":"48614696899813820741583845545005728969"},"id":"CVE-2023-38493-c316a6d5","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/PrefixPathMapping.java","function":"PrefixPathMapping"}},{"digest":{"function_hash":"210158684994183568172255714158765867690","length":2027},"id":"CVE-2023-38493-c6bec8b9","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"tomcat10/src/main/java/com/linecorp/armeria/server/tomcat/TomcatService.java","function":"convertRequest"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"function":"serve","file":"jetty/jetty9/src/main/java/com/linecorp/armeria/server/jetty/JettyService.java"},"deprecated":false,"digest":{"function_hash":"133471019411941816251447013023336161563","length":1499},"id":"CVE-2023-38493-c89a3572"},{"id":"CVE-2023-38493-cb2652ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"decodePercentsAndEncodeToUtf8"},"deprecated":false,"digest":{"function_hash":"192618125807981032907878461244545602321","length":2950}},{"id":"CVE-2023-38493-d83ca454","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/common/Flags.java"},"deprecated":false,"digest":{"line_hashes":["274698404463636358537416914673684539814","158584188522089177711503602982429443021","32309056482319158521898630113197339813","128255691787990829903160531320491735821","240840203720783684183949966395147626171","128052735732885474211174957221361343968"],"threshold":0.9}},{"digest":{"function_hash":"324466711999907249058337586609485910508","length":180},"id":"CVE-2023-38493-e20a0496","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/internal/common/DefaultRequestTarget.java","function":"forServer"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["276768056824744657036126463746164677149","320044189866087310468228946895980901873","121564744594966680749311159708973071512","201183794983905540848359159269419393519","14010507939775939439616827980344943690","59265291666118132411082970609088941226","154031231259923449820060673995243400511","104239585583618474585356259474979407010"],"threshold":0.9},"id":"CVE-2023-38493-e595099c","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/ExactPathMapping.java"}},{"source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/PrefixPathMapping.java"},"deprecated":false,"digest":{"line_hashes":["249929268220721018272215380144545465504","320044189866087310468228946895980901873","140751484261608205147139999644165471986","215546331131675369310561404218220621553","252739735958723935235890029504292801063","330718470000752313347686477955561374276","236445787204283818973010648012657382009","39137680310932924878505060225134176636"],"threshold":0.9},"id":"CVE-2023-38493-e8c8d149","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"29066691665815297153248204283611996197","length":2192},"id":"CVE-2023-38493-f4e8804d","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"tomcat10/src/main/java/com/linecorp/armeria/server/tomcat/TomcatService.java","function":"serve"}},{"signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/test/java/com/linecorp/armeria/internal/common/DefaultRequestTargetTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["84793492958205851201158355147836799793","230213606932602085427164481253707524133","293097311057526650657184237192855769716","68796616303191385945322038294649470903","214370956810013161701053030395080796401","292740958268187213076777027737081947342","35182933696647592063554925395026676471","327765148904025739146298683535852034339","288026596905379860188786311098222512113","82941524135169223804293370314188159527","142153955861517826620450363365529858686","83603682427683535574097518942168496876","81818393435624002716918253516937849063","132103360932427450827033657625006763549","60590152312184276977505216695505667167","206657604703666294837201878085907994565","13844802096599179599590372138708397669","307397288731507482878223279394608159033","31843011558998912310666402283725977615","253278410262185547286858523312652806064","124040634816973342136815661121268317257","126110415440676216153082358406185540770","8765884898429320938968439166039146233","326061699140246224185093333302825226716","255722915080587431314783245346054703219","25383417553469255511893798652621855780","117301501053255314649017031043266547781","194771169176178934204945475695982276361","8698498978715332014874922676768550928","241391792999063521362404841884113322321","152922205671171534027814562891025336026","152578596227359442273979451273353311493","113041957419183156500427179179022657377","287677122283120867109116425763575104883","132313411346663068684956334695648418266","313918888400340795665950308901453091909","306743547186826261319801543982413962583","307991557741731048591637789028184907079","170489015452374421906450844335301014862","214351348124834339714910228308009664166","155517974082695695057413084385154591974","41385421976858421667060084046247492384"]},"id":"CVE-2023-38493-fa7596ad","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["192270877567192028090621715943881248006","306129135417370661103588560366529428190","136401770539934681615553456269483300583","122586545542369401571180535506116243513","243211199332496142767970211802610858129","19378373484169551533946712854845210985","100729916843332838610658443178577252762","37126175015951598155690225278567840762","235101535180176685163074740342072249702","334496308430610341012602898744253238227","111319878483947754857281390630109792090","173056569948460054599987619800511851472","16746756337068244547913083236599332163","196976676816697104140301260744121661846","145573541506288267511835211047526527023","331273737740218374649677037286522857152","133009210417669055234885699901608903790","160842493987305518488447884163143815474","193871484672863332497509769893759662292","238105668035034700476176424119320604708","89906577684017112753168362799632141845","199608340624273407472906852412268670862","163993258301479408307638021660241356634","112200635425099125218253838205038651723","98363831538589753520849431498703726269","296981235622240462647615233760666289257","113514635548940766701189868499256160988","159249767093655424357640003635641421818","141713177784874278071064995435019335360","93057422045651685699160508387984300106","43333138293589105653108102450519393414"],"threshold":0.9},"id":"CVE-2023-38493-fade0e91","signature_type":"Line","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"jetty/jetty11/src/main/java/com/linecorp/armeria/server/jetty/JettyService.java"}},{"signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"core/src/main/java/com/linecorp/armeria/server/ParameterizedPathMapping.java","function":"ParameterizedPathMapping"},"deprecated":false,"digest":{"function_hash":"304164418488216153584206126286402698208","length":1517},"id":"CVE-2023-38493-fb1ba54d","signature_type":"Function"},{"digest":{"function_hash":"73772252568999761424105192843691536516","length":1169},"id":"CVE-2023-38493-ff3e6679","signature_type":"Function","signature_version":"v1","source":"https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07","target":{"file":"jetty/jetty11/src/main/java/com/linecorp/armeria/server/jetty/JettyService.java","function":"toRequestMetadata"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}