Vulnerability details
CVE-2026-39852
Quarkus authorization bypass via semicolon path normalization inconsistency
Official description
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| 8.2High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Process Automation 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of OptaPlanner 8 | All | CVEProject cvelistV5 (CNA) |
| quarkusio | quarkus | < 3.20.6.1 | CVEProject cvelistV5 (CNA) |
| quarkusio | quarkus | >= 3.27.3.0, < 3.27.3.1 | CVEProject cvelistV5 (CNA) |
| quarkusio | quarkus | >= 3.34.0, < 3.34.7 | CVEProject cvelistV5 (CNA) |
| quarkusio | quarkus | >= 3.35.0, < 3.35.2 | CVEProject cvelistV5 (CNA) |
References and advisories
11- https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9 x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-39852 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2457819 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39852.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:17789 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25089 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13631 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11720 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11721 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
Details
- Published
- 2026-05-06
- Last updated
- 2026-08-17
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-863Incorrect Authorization
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization