The flaw in Quarkus REST Data Panache is an input‑validation error that allows an attacker to send arbitrary sort parameters in GET requests. Because the application forwards the unsanitised parameter to the underlying database, privileged data may be extracted and more complex queries can be articulated, exhausting database resources and causing a denial of service. The weakness is identified as CWE‑20.

The vulnerable component is part of Red Hat’s build of Quarkus, specifically the REST Data Panache module. The affected packages are Red Hat Exploit Intelligence 0 and Red Hat Quarkus 3. No explicit version range is given; the advisory implies all instances of these packages contain the flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. The vulnerability may be exercised via the REST endpoint that accepts a sort query parameter; access to that endpoint is likely available to any host that can reach the service. This inference is drawn from the description that the flaw can be triggered by an attacker. Because the weakness is an input validation problem, proper sanitisation or whitelisting would stop the attack.