Read the docs
TI-2026-28734 Aliases CVE-2026-39852GHSA-rc95-pcm8-65v9

Quarkus authorization bypass via semicolon path normalization inconsistency

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Partial Red Hat: 8 fixed, 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00712 53rd percentileScored 2026-11-07
Fix Partial quarkus (quarkusio): 3.20.6.1, 3.27.3.1, 3.34.7 +1io.quarkus:quarkus-vertx-http (Maven): 3.20.6.1, 3.27.3.1, 3.33.1.1 +1Red Hat: 8 advisoriesRed Hat: 8 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
quarkusioquarkusbefore 3.20.6.1; 3.27.3.0 to before 3.27.3.1; 3.34.0 to before 3.34.7; 3.35.0 to before 3.35.23.20.6.1, 3.27.3.1, 3.34.7, 3.35.2Patch availableCNA
—io.quarkus:quarkus-vertx-http (Maven)before 3.20.6.13.20.6.1Patch availableGHSA-rc95-pcm8-65v9
—io.quarkus:quarkus-vertx-http (Maven)3.21.0 to before 3.27.3.13.27.3.1Patch availableGHSA-rc95-pcm8-65v9
—io.quarkus:quarkus-vertx-http (Maven)3.30.0 to before 3.33.1.13.33.1.1Patch availableGHSA-rc95-pcm8-65v9
—io.quarkus:quarkus-vertx-http (Maven)3.34.0 to before 3.35.1.13.35.1.1Patch availableGHSA-rc95-pcm8-65v9
  • quarkus Vendorquarkusio Affected before 3.20.6.1; 3.27.3.0 to before 3.27.3.1; 3.34.0 to before 3.34.7; 3.35.0 to before 3.35.2 Fixed in 3.20.6.1, 3.27.3.1, 3.34.7, 3.35.2 Patch available CNA
  • io.quarkus:quarkus-vertx-http (Maven) Vendor— Affected before 3.20.6.1 Fixed in 3.20.6.1 Patch available GHSA-rc95-pcm8-65v9
  • io.quarkus:quarkus-vertx-http (Maven) Vendor— Affected 3.21.0 to before 3.27.3.1 Fixed in 3.27.3.1 Patch available GHSA-rc95-pcm8-65v9
  • io.quarkus:quarkus-vertx-http (Maven) Vendor— Affected 3.30.0 to before 3.33.1.1 Fixed in 3.33.1.1 Patch available GHSA-rc95-pcm8-65v9
  • io.quarkus:quarkus-vertx-http (Maven) Vendor— Affected 3.34.0 to before 3.35.1.1 Fixed in 3.35.1.1 Patch available GHSA-rc95-pcm8-65v9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 3.20.6.1; 3.21.0 to before 3.27.3.1; 3.28.0 to before 3.33.1.1; 3.34.0 to before 3.34.7; 3.35.0 to before 3.35.2Vulnerablequarkusio
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 3.20.6.1; 3.21.0 to before 3.27.3.1; 3.28.0 to before 3.33.1.1; 3.34.0 to before 3.34.7; 3.35.0 to before 3.35.2 Vulnerable ·quarkusio

Remediation

  • Fix · CNA quarkus (quarkusio) Fixed in 3.20.6.1, 3.27.3.1, 3.34.7, 3.35.2
  • Fix · GHSA-rc95-pcm8-65v9 io.quarkus:quarkus-vertx-http (Maven) Fixed in 3.20.6.1 Advisory →
  • Fix · GHSA-rc95-pcm8-65v9 io.quarkus:quarkus-vertx-http (Maven) Fixed in 3.27.3.1 Advisory →
  • Fix · GHSA-rc95-pcm8-65v9 io.quarkus:quarkus-vertx-http (Maven) Fixed in 3.33.1.1 Advisory →
  • Fix · GHSA-rc95-pcm8-65v9 io.quarkus:quarkus-vertx-http (Maven) Fixed in 3.35.1.1 Advisory →

Red Hat 8 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
Show 5 more Red Hat advisories
  • RHSA-2026:25089 Released 2026-06-10 · Red Hat rating Important
    HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.4.0
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:13631 Released 2026-05-05 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)
    • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • RHSA-2026:11720 Released 2026-05-05 · Red Hat rating Important
    Red Hat build of Quarkus 3.20.6.SP1 security update
    • Red Hat build of Quarkus 3.20.6.SP1 io.quarkus.quarkus-vertx-http-3.20.6.redhat-00003.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.84.0.redhat-00001.jar
  • RHSA-2026:11721 Released 2026-05-05 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.3.SP1 security update
    • Red Hat build of Quarkus 3.27.3.SP1 io.quarkus.quarkus-vertx-http-3.27.3.redhat-00002.jar, org.apache.kafka.kafka-clients-4.0.2.redhat-00001.jar, org.bouncycastle.bcpkix-jdk18on-1.84.0.redhat-00001.jar +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
HawtIO HawtIO 4.4.0Fixed RHSA-2026:25089
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27Fixed RHSA-2026:13631
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat build of Quarkus 3.20.6.SP1Fixed RHSA-2026:11720
Red Hat build of Quarkus 3.27.3.SP1Fixed RHSA-2026:11721
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 8 products
  • Cryostat 4 on RHEL 9
  • Red Hat Build of Keycloak
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat build of Quarkus 3.20.6.SP1
  • Red Hat build of Quarkus 3.27.3.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39852
  2. 2026-10-03 Alias added: GHSA-rc95-pcm8-65v9
  3. 2026-10-09 Fix available: RHSA-2026:13631 · Red Hat
  4. 2026-10-10 Fix available: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat
  6. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  7. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
  8. 2026-11-01 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 11

  • TI-2022-06097 Unchecked Class Instantiation when providing Plugin Classes CVSS 3.1CRITICAL 9.8
  • TI-2026-37281 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities CVSS 3.1HIGH 7.5
  • TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
  • TI-2020-15666 XML external entity injection in jackson-databind CVSS 3.1HIGH 7.5
  • TI-2017-13794 The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load… CVSS 3.1HIGH 7.5
  • TI-2021-08126 block repositories using http by default CVSS 3.1CRITICAL 9.1
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences