Path-based Authorization Bypass in Quarkus Java Framework

CVE-2026-39852

What is CVE-2026-39852?

Quarkus, a cloud-native Java framework, possesses a vulnerability related to path normalization inconsistencies between its security and routing layers. In affected versions, an unauthorized user can exploit this flaw by appending semicolons and arbitrary text to a request URL, resulting in the bypass of HTTP path-based authorization policies. This occurs because the security layer validates the raw URL path with matrix parameters preserved, while the routing layer strips these parameters during endpoint matching. Consequently, an attacker can gain access to protected resources without proper authorization. The issue has been remediated in several recent updates.

References