A path‑normalization inconsistency in Quarkus allows an attacker to append a semicolon and arbitrary text to a URL (for example, /api/admin;anything) so that the security layer authorizes the request while the routing layer resolves the request to a protected endpoint. This flaw enables unauthenticated or low‑privileged users to access resources guarded by HTTP path‑based policies, effectively granting them higher privileges than intended. The vulnerability stems from the mismatch in handling matrix parameters between the security layer (which preserves them) and RESTEasy Reactive (which strips them).

The issue affects all releases of Quarkus prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7 and 3.35.2. Organizations using the Quarkus framework for web services should verify their installed version and identify whether they run a vulnerable release.

The flaw carries a CVSS score of 8.8, indicating a high severity. Because the attack requires only a crafted HTTP request and does not need any pre‑existing credentials, the risk surface is broad. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitability is straightforward: an attacker can directly reach the protected endpoint over the network, potentially achieving unauthorized actions if the endpoint performs privileged functions.