CVE-2026-19625

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

A vulnerability in Quarkus allows bypassing HTTP path-based authorization policies using encoded semicolons (%3B) and slashes (%2F or %5C).

Quarkus before versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 has a path normalization inconsistency between the security layer and routing. An attacker can bypass authorization policies by appending a semicolon and arbitrary text to the URL (e.g., /api/admin;anything).

A flaw in the RESTEasy Reactive implementation in Quarkus causes security checks for some JAX-RS endpoints to be performed after serialization, consuming more processing resources during HTTP request checks. In certain configurations, an attacker knowing POST, PUT, or PATCH request paths can potentially overload vulnerable endpoints, leading to denial of service.

A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.

A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.