PT-2026-36916 · Quarkus · Quarkus

P- · Published 2026-05-04 · Updated 2026-05-26 · CVE-2026-39852

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Quarkus version 3.32.4

Description An authorization bypass exists where semicolons used as matrix parameters in HTTP requests can circumvent security constraints, potentially granting unauthorized access to protected resources. Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (;) and arbitrary text to the request URL. This occurs due to a path-normalization inconsistency: the security layer performs authorization checks on the raw URL path, while the RESTEasy Reactive routing layer strips matrix parameters before matching endpoints. Consequently, a request to an endpoint like "/api/admin;anything" may bypass policies protecting "/api/admin" while still being routed to that protected endpoint.

Recommendations Update Quarkus version 3.32.4 to a patched version.

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

CLEANSTART-2026-VJ37814

CVE-2026-39852

GHSA-RC95-PCM8-65V9

Affected Products

Quarkus

References · 72

• https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42578 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59250 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41417 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42198 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-VJ37814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1002 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42580 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5598 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39852 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42584 · Security Note
• https://osv.dev/vulnerability/GHSA-rc95-pcm8-65v9 · Vendor Advisory