EOL Fix Available | CVE-2026-39852

Overview

Quarkus is a Kubernetes-native Java framework optimized for cloud-native applications, containers, and serverless workloads. It is designed around fast startup, low memory use, build-time processing, and developer-friendly integrations across REST, HTTP, security, data, messaging, and observability extensions.

An Authorization Bypass vulnerability (CVE-2026-39852) has been identified in Quarkus HTTP security path matching, which allows unauthenticated or lower-privileged attackers to bypass path-based authorization policies by adding semicolon-delimited matrix parameters to protected request paths.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Quarkus that include the io.quarkus:quarkus-vertx-http package and path-based HTTP security policies.

‍

Details

Module Info

Product: Quarkus
Affected packages: io.quarkus:quarkus-vertx-http
Affected versions: <3.20.6.1, >=3.21.0 <3.27.3.1, >=3.30.0 <3.33.1.1, >=3.34.0 <3.35.1.1
GitHub repository: https://github.com/quarkusio/quarkus
Published packages: https://central.sonatype.com/artifact/io.quarkus/quarkus-vertx-http
Package manager: Maven
Fixed in:
- NES for Quarkus 2.16.x
- OSS Quarkus 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7 and 3.35.2

Vulnerability Info

This High-severity vulnerability is found in the io.quarkus:quarkus-vertx-http package in multiple versions of Quarkus. Quarkus can protect endpoints with path-based HTTP security policies, such as policies that require authentication or a specific role for /api/admin. The flaw is that the security layer matches those policies against a request path that still contains semicolon-delimited matrix parameters, while REST routing strips those matrix parameters before selecting the endpoint.

In affected versions, the path policy matcher uses the request path directly:

PathMatcher.PathMatch<List<HttpMatcher>> toCheck = pathMatcher.match(routingContext.normalizedPath());
// ...
PathMatcher.PathMatch<List<HttpMatcher>> toCheck = pathMatcher.match(rc.normalizedPath());

If an application protects /api/admin, an attacker can request /api/admin;anything. The security matcher can treat that as a different path and fail to apply the /api/admin policy, while routing strips the matrix data and dispatches to the protected endpoint. The same mismatch can affect related security integrations that consume the unstripped path for Keycloak authorization, servlet security checks, or CSRF token path matching. Depending on the application's policy configuration, the request can be allowed without the authentication or authorization that the endpoint was intended to require.

‍

Mitigation

Only recent versions of Quarkus are community-supported. The affected 2.16.x line is End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

Upgrade Quarkus to a currently supported release that contains the fix.
Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍