Data Exposure and Performance Degradation in Quarkus REST Data Panache by Red Hat
CVE-2026-94451

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Quarkus 3.27.6.Red Hat
Red Hat Build Of Quarkus 3.33.4.Red Hat
Exploit Intelligence
Vendor
CVE Published:
12 October 2026

What is CVE-2026-94451?

A vulnerability in Quarkus REST Data Panache occurs due to improper validation of user-provided sort parameters in certain REST endpoints. This flaw could allow malicious actors to extract sensitive information beyond their authorization or to overload the database with complex sorting tasks, potentially leading to significant system slowdown and denial of service incidents.

Affected Version(s)

Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004

Red Hat build of Quarkus 3.33.4.redhat 3.33.4.redhat-00004

References

https://access.redhat.com/errata/RHSA-2026:83082
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83520
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-94451
vdb-entryx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.