CVE-2026-39852High· 8.2▾ TwilightQuarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.6%
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.
quarkus < 3.20.6.1quarkus >= 3.21.0, < 3.27.3.1quarkus >= 3.28.0, < 3.33.1.1quarkus >= 3.34.0, < 3.34.7quarkus >= 3.35.0, < 3.35.2Upgrade past the affected range:
quarkus 3.35.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50559High· 7.5Quarkus is a Java framework for building cloud-native applications
CVE-2025-66560Medium· 5.9Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications
CVE-2023-6394High· 7.4A flaw was found in Quarkus
CVE-2026-28808Critical· 9.8Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside Docum…
CVE-2023-4853High· 8.1A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions
CVE-2026-12894High· 8.8A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails