CVE-2026-94451

Overview

Quarkus is a Kubernetes-native Java framework optimized for cloud-native applications, containers, and serverless workloads. It builds on standard libraries (Jakarta EE, Eclipse Vert.x, Hibernate, Netty) and compiles to both JVM and GraalVM native images for fast startup and low memory use. The REST Data Panache extension generates CRUD REST endpoints for Panache entities and repositories from a resource interface. The issue affects versions of Quarkus that include the io.quarkus:quarkus-hibernate-orm-rest-data-panache, io.quarkus:quarkus-hibernate-reactive-rest-data-panache, io.quarkus:quarkus-mongodb-rest-data-panache, and io.quarkus:quarkus-spring-data-rest packages.

A denial of service vulnerability (CVE-2026-94451) has been identified in the list endpoints that Quarkus REST Data Panache generates for non-paged resources, which allows attackers to send an unvalidated sort parameter that forces the database to perform expensive queries. The same unchecked parameter can also be used to learn information the caller should not have access to.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others.

This issue affects Quarkus releases from 1.8.0.CR1 onward that include REST Data Panache.

Details

Module Info

• Product: Quarkus
• Affected packages:
  • io.quarkus:quarkus-hibernate-orm-rest-data-panache
  • io.quarkus:quarkus-hibernate-reactive-rest-data-panache
  • io.quarkus:quarkus-mongodb-rest-data-panache
  • io.quarkus:quarkus-spring-data-rest
• Affected versions: >= 1.8.0.CR1 < 3.27.6.1, >= 3.28.0.CR1 < 3.33.4.1, >= 3.34.0.CR1 < 3.40.1.1
• GitHub repository: https://github.com/quarkusio/quarkus
• Published packages: https://central.sonatype.com/artifact/io.quarkus/quarkus-hibernate-orm-rest-data-panache, https://central.sonatype.com/artifact/io.quarkus/quarkus-hibernate-reactive-rest-data-panache, https://central.sonatype.com/artifact/io.quarkus/quarkus-mongodb-rest-data-panache, https://central.sonatype.com/artifact/io.quarkus/quarkus-spring-data-rest
• Package manager: Maven
• Fixed in:
  • NES for Quarkus v2.16.18, v3.20.11
  • Quarkus v3.27.6.1, v3.33.4.1, v3.40.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the io.quarkus:quarkus-hibernate-orm-rest-data-panache, io.quarkus:quarkus-hibernate-reactive-rest-data-panache, io.quarkus:quarkus-mongodb-rest-data-panache, and io.quarkus:quarkus-spring-data-rest packages in Quarkus 1.8.0.CR1 and later. REST Data Panache builds the list endpoint of a resource at build time in ListMethodImplementor. When the resource is paged (the default), the generated method carries the @SortQueryParamValidator annotation, which binds SortQueryParamFilter to the endpoint. That filter checks every comma-separated sort value against a field-name pattern and rejects anything else with 400 Bad Request. When the resource is declared with @ResourceProperties(paged = false), implementNotPaged builds the method without that annotation:

// Add method annotations
addGetAnnotation(methodCreator);
addPathAnnotation(methodCreator, resourceProperties.getPath(RESOURCE_METHOD_NAME));
addProducesJsonAnnotation(methodCreator, resourceProperties);
addLinksAnnotation(methodCreator, resourceProperties, resourceMetadata.getEntityType(), REL);
addMethodAnnotations(methodCreator, resourceProperties.getMethodAnnotations(RESOURCE_METHOD_NAME));
addOpenApiResponseAnnotation(methodCreator, Response.Status.OK, resourceMetadata.getEntityType(), true);
addSecurityAnnotations(methodCreator, resourceProperties);
addQueryParamAnnotation(methodCreator.getParameterAnnotations(0), "sort");
addQueryParamAnnotation(methodCreator.getParameterAnnotations(1), "namedQuery");

The filter therefore never runs for the non-paged endpoint. SortImplementor.getSort splits the raw sort query values on commas and adds each one, minus an optional leading -, to a Panache Sort without any check. Panache then writes each sort name into the ORDER BY clause of the query, quoting every dot-separated segment as an entity attribute path. Because the field-name pattern that would reject dots never runs, any client that can reach the endpoint can sort by paths into associated entities, including attributes that the endpoint does not return. Sorting through associations makes the database join and order across related tables on every request, and the resulting order of the returned records lets the caller infer values of properties it should not see.

Mitigation

Only recent versions of Quarkus are community-supported. Older lines are End-of-Life and will not receive public updates to address this issue. Quarkus LTS releases are maintained for 12 months from release; see the project's LTS release policy.

Resources that keep the default paged list endpoint already validate the sort parameter, so avoiding @ResourceProperties(paged = false) keeps requests off the unvalidated code path.

Users of the affected components should apply one of the following mitigations:

• Upgrade Quarkus to a currently supported release that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.