CVE-2026-39852

Quarkus authorization bypass via semicolon path normalization inconsistency

View on CVE.org
Published May 5, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Description
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.

Analysis

AI-generated

Technical impact

A path‑normalization inconsistency in Quarkus allows an attacker to append a semicolon and arbitrary text to a URL (for example, /api/admin;anything) so that the security layer authorizes the request while the routing layer resolves the request to a protected endpoint. This flaw enables unauthenticated or low‑privileged users to access resources guarded by HTTP path‑based policies, effectively granting them higher privileges than intended. The vulnerability stems from a mismatch in handling matrix parameters between the security layer (which preserves them) and RESTEasy Reactive (which strips them), representing a path normalization issue (CWE‑863) and an access control bypass (CWE‑551).

Affected Systems

The issue affects all releases of Quarkus prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7 and 3.35.2. Organizations using the Quarkus framework for web services should verify their installed version and identify whether they run a vulnerable release.

Risk and Exploitability

The flaw carries a CVSS score of 8.8, indicating a high severity. Because the attack requires only a crafted HTTP request and does not need any pre‑existing credentials, the risk surface is broad. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitability is straightforward: an attacker can directly reach the protected endpoint over the network, potentially achieving unauthorized actions if the endpoint performs privileged functions.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Quarkus to any supported release that includes the fix, such as 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, or 3.35.2, or any later version that has merged these patches.
  • Modify the application or RESTEasy Reactive configuration to strip or reject semicolons and matrix parameters from request paths before authentication checks are performed, ensuring that path normalization is consistent across layers.
  • Deploy a reverse‑proxy or firewall rule that rejects URLs containing semicolons to block the bypass attempt until a patch is applied.

Generated by OpenCVE AI on May 6, 2026 at 01:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-rc95-pcm8-65v9 Quarkus has Authentication/Authorization bypasses
History
Type Values Removed Values Added
References
Type Values Removed Values Added
CPEs cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

 cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Quarkus
Quarkus quarkus
Vendors & Products Quarkus
Quarkus quarkus
Type Values Removed Values Added
First Time appeared Redhat
Redhat apache Camel Quarkus
Redhat quarkus
Weaknesses CWE-551
CPEs cpe:/a:redhat:apache_camel_quarkus:3.27
cpe:/a:redhat:quarkus:3.20::el8
cpe:/a:redhat:quarkus:3.27::el8
Vendors & Products Redhat
Redhat apache Camel Quarkus
Redhat quarkus
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

threat_severity

Important
Type Values Removed Values Added
Description Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.
Title Quarkus authorization bypass via semicolon path normalization inconsistency
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}
Earlier changes (1)
Weaknesses
  • CWE-551

    Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

  • CWE-863

    Incorrect Authorization

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Aug 17, 2026, 12:05 PM
Reserved
Apr 7, 2026, 7:13 PM

View source JSON

Updated
Aug 17, 2026, 12:05 PM

JSON

Status
Modified
Published
May 5, 2026, 9:16 PM
Modified
Aug 17, 2026, 12:18 PM

View source JSON

Severity
Important
Public date
May 4, 2026, 12:00 AM

View source Bugzilla JSON

Updated
May 6, 2026, 9:00 AM

JSON