A flaw in Armeria processes request paths inconsistently, allowing an attacker to craft URLs that bypass the service’s path‑based authorization checks. The vulnerability can cause unauthorized disclosure or modification of resources that should be protected, impacting confidentiality and integrity across the application.

The issue affects LY Corporation’s Armeria framework in all releases before 1.43.0. Applications built with these older versions are at risk if they expose path‑controlled resources to the network without additional safeguards.

With a CVSS score of 8.7, the vulnerability is high severity. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, but it remains exploitable by unauthenticated attackers via normal HTTP traffic. Attackers can target vulnerable deployments by issuing specially crafted requests that exploit the inconsistent normalisation logic to reach protected endpoints.