A flaw exists in Quarkus that lets a remote attacker send specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes. The encoded characters are mis‑parsed by the framework, allowing an attacker to bypass HTTP path‑based authorization policies and access protected static resources that should otherwise be restricted. The result can be uncontrolled disclosure of sensitive data, classified under CWE‑551.

Affected products include Quarkus versions 3.20, 3.27 and 3.33 running on Red Hat Enterprise Linux 8, as well as Apache Camel Quarkus 3.33. All installations that rely on Quarkus' vertx‑http module and enforce path‑based access controls are susceptible when they employ encoded characters in URLs.

The vulnerability carries a CVSS score of 7.5, indicating high severity and a remote attack vector that requires network access. EPSS is not available, and the issue is not listed in CISA's KEV catalog, but the lack of the score does not imply low risk; attackers can readily construct the exploit in a web application that depends on the affected Quarkus version. Because the flaw affects authorization checks rather than authentication, typical intrusion detection systems may not flag the activity, making mitigation especially important.