CVE-2026-39852
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Quarkus before versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2 has a path normalization inconsistency between the security layer and routing. An attacker can bypass authorization policies by appending a semicolon and arbitrary text to the URL (e.g., /api/admin;anything).
Risk Assessment
Unauthenticated or low-privileged users can access protected endpoints, potentially leading to unauthorized access to data or functions.
Recommendation
Update Quarkus to one of the patched versions: 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, or 3.35.2.
Other vulnerabilities in Quarkus
See all- CVE-2026-50559High
A vulnerability in Quarkus allows bypassing HTTP path-based authorization policies using encoded semicolons (%3B) and slashes (%2F or %5C).
- CVE-2024-1726Medium
A flaw in the RESTEasy Reactive implementation in Quarkus causes security checks for some JAX-RS endpoints to be performed after serialization, consuming more processing resources during HTTP request checks. In certain configurations, an attacker knowing POST, PUT, or PATCH request paths can potentially overload vulnerable endpoints, leading to denial of service.
- CVE-2024-1979Low
A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
- CVE-2023-4853High
A flaw in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. An attacker could bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Original NVD description (English source)
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.