CVE-2026-39852

Quarkus authorization bypass via semicolon path normalization inconsistency

HIGH

8.2

CVSS Score

Published: May 5, 2026 at 08:58 PM UTC

Updated: August 17, 2026 at 12:18 PM UTC

10 products affected across 3 vendorsQuarkusOpenShift AIJBoss Enterprise Application Platform Expansion Pack

Using quarkus by quarkusio?

Get instant alerts when new vulnerabilities affect quarkus - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.2

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Quarkus · Quarkus

95%

v < 3.20.6.13.21.0 ≤ v < 3.27.3.13.28.0 ≤ v < 3.33.1.13.34.0 ≤ v < 3.34.73.35.0 ≤ v < 3.35.2

Affected range stops below 3.20.6.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.27.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.33.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.34.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.35.2, so it looks safe — our inference, not a vendor statement

Quarkus · Quarkusio

60%

v < 3.20.6.1v < 3.27.3.1v < 3.34.7v < 3.35.2

Affected range stops below 3.20.6.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.27.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.34.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.35.2, so it looks safe — our inference, not a vendor statement

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Build of Apicurio Registry · Red Hatrpm

60%

Build of Debezium · Red Hatrpm

60%

Build of Optaplanner · Red Hatrpm

60%

JBoss Enterprise Application Platform Expansion Pack · Red Hatrpm

60%

All versions

OpenShift AI · Red Hatcontainer

60%

All versions

OpenShift Serverless · Red Hatrpm

60%

All versions

Process Automation · Red Hatrpm

60%

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/quarkusio/quarkus/security/advisories/GHSA-rc95-pcm8-65v9