PT-2026-36916 · Quarkus · Quarkus

P- · CVE-2026-39852 · Published 2026-05-04 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Quarkus version 3.32.4

Description An authorization bypass exists where semicolons used as matrix parameters in HTTP requests can circumvent security constraints, potentially granting unauthorized access to protected resources. Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (;) and arbitrary text to the request URL. This occurs due to a path-normalization inconsistency: the security layer performs authorization checks on the raw URL path, while the RESTEasy Reactive routing layer strips matrix parameters before matching endpoints. Consequently, a request to an endpoint like "/api/admin;anything" may bypass policies protecting "/api/admin" while still being routed to that protected endpoint.

Recommendations Update Quarkus version 3.32.4 to a patched version.

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

CWE-551

Related Identifiers

CLEANSTART-2026-BK55944

CLEANSTART-2026-KL03760

CLEANSTART-2026-NE94194

CLEANSTART-2026-VJ37814

CLEANSTART-2026-YY96069

CVE-2026-39852

GHSA-RC95-PCM8-65V9

Affected Products

Quarkus

References · 157

• https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:11721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33871 · Security Note
• https://access.redhat.com/errata/RHSA-2026:13631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42198 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-VJ37814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47244 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-YY96069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54517 · Security Note
• https://access.redhat.com/errata/RHSA-2026:17789 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-BK55944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50020 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-57914 · Security Note
• https://access.redhat.com/errata/RHSA-2026:11720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54512 · Security Note