CVE-2024-1726
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A flaw in the RESTEasy Reactive implementation in Quarkus causes security checks for some JAX-RS endpoints to be performed after serialization, consuming more processing resources during HTTP request checks. In certain configurations, an attacker knowing POST, PUT, or PATCH request paths can potentially overload vulnerable endpoints, leading to denial of service.
Risk Assessment
The risk is the possibility of a DoS attack, which can disrupt the availability of Quarkus-based applications. The attack requires knowledge of paths but can be performed remotely.
Recommendation
It is recommended to update Quarkus to a patched version and restrict access to sensitive endpoints. Also monitor resource usage.
Other vulnerabilities in Quarkus
See all- CVE-2026-87743High
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.
- CVE-2026-19625Medium
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, and an optional token introspection cache is enabled, a valid token issued by one OIDC provider can also be used to access an endpoint secured by another OIDC provider.
- CVE-2026-50559High
A vulnerability in Quarkus allows bypassing HTTP path-based authorization policies using encoded semicolons (%3B) and slashes (%2F or %5C).
- CVE-2026-39852High
Quarkus before versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 has a path normalization inconsistency between the security layer and routing. An attacker can bypass authorization policies by appending a semicolon and arbitrary text to the URL (e.g., /api/admin;anything).
- CVE-2025-66560Medium
In the Quarkus framework before versions 3.31.0, 3.27.2, and 3.20.5, there is a vulnerability in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits for previously written chunks to be fully transmitted; if the client connection is dropped, the worker thread is never released and becomes permanently blocked. This can exhaust worker threads, leading to degraded performance or complete unavailability.
- CVE-2024-1979Low
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- CVE-2023-4853High
A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Original NVD description (English source)
A flaw was discovered in the RESTEasy Reactive implementation in Quarkus. Due to security checks for some JAX-RS endpoints being performed after serialization, more processing resources are consumed while the HTTP request is checked. In certain configurations, if an attacker has knowledge of any POST, PUT, or PATCH request paths, they can potentially identify vulnerable endpoints and trigger excessive resource usage as the endpoints process the requests. This can result in a denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS