CVE-2026-39852: quarkus Incorrect Authorization

Vulnerability summary

CVE-2026-39852 is a high (CVSS 8.8) Incorrect Authorization vulnerability in quarkus. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.3% of scored vulnerabilities.

Timeline

1. 05-05-2026
   PublishedVulnerability first disclosed.
2. 17-08-2026
   Last modifiedVulnerability information updated.

Description

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.