# CVE-2026-121823: LINE Armeria path normalization auth bypass

Source: https://junglewise.ai/threats/cve-2026-121823-a-vulnerability-has-been-identified-in-armeria-versions-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-121823 · Severity: info · Published 2026-11-06

Armeria is a Java web framework that handles HTTP requests and serves files. The framework fails to properly normalize certain path segments (like /./) when checking access controls, allowing attackers to bypass authentication and access protected resources without permission. This affects servers that use Armeria's path-based decorators or file services to protect sensitive areas.

Technologies: [LINE Armeria](https://junglewise.ai/threats/technologies/line-armeria). Vendors: [LINE](https://junglewise.ai/threats/vendors/line).

## Quick answers

**Is CVE-2026-121823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121823 being exploited in the wild.

**How severe is CVE-2026-121823?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** LINE Armeria < 1.43.0 (from 1.13 onwards).

**Is there a fix for CVE-2026-121823?** Yes: fixed in 1.43.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121823 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121823?** Check whether you run LINE Armeria at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.43.0

## Technical details

The vulnerability stems from inconsistent path normalization: Armeria's request routing rejects .. but preserves . and %2e-decoded path segments, while underlying file systems (FileService, TomcatService, JettyService) normalize these away. An attacker can request /./ or /%2e/ prefixed paths to bypass decoratorUnder("/admin") checks that rely on string prefix matching. The flaw affects all versions from 1.13 through 1.42.0 and is exploitable remotely without authentication or user interaction.

## Affected products

- LINE Armeria < 1.43.0 (from 1.13 onwards)

## Timeline

- 2026-11-06: disclosed: Advisory published
- 2026-11-06: patched: Version 1.43.0 released with fix

## References

- [https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v](https://github.com/line/armeria/security/advisories/GHSA-xqhm-4ph4-423v)
- [https://line.github.io/security-advisory-blog/CVE-2026-121823/](https://line.github.io/security-advisory-blog/CVE-2026-121823/)

## Related threats

- [Line Armeria Thrift denial of service via excessive memory allocation](https://junglewise.ai/threats/cve-2026-121824-a-vulnerability-has-been-identified-in-armeria-versions-prior-to)
- [Armeria FileService stored XSS in directory listing](https://junglewise.ai/threats/cve-2026-121822-a-vulnerability-has-been-identified-in-armeria-versions-0-80-0)