CVE-2026-39852: Quarkus authorization bypass via semicolon in HTTP path

CVE-2026-39852 · Severity: high · CVSS 8.2 · Published 2026-05-05

Quarkus, a popular Java framework for building cloud-native applications, is affected by a security flaw that allows attackers to bypass access controls. By adding specific characters like semicolons to a web address, an unauthorized user can trick the system into granting access to restricted administrative or private data. This could lead to the exposure of sensitive information or unauthorized actions within the application.

Technologies: io.quarkus:quarkus-vertx-http (Maven), Red Hat Build of Apache Camel for Quarkus. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-39852 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39852 being exploited in the wild.
How severe is CVE-2026-39852?
High severity, with a CVSS score of 8.2, published 5 May 2026.
Which products and versions are affected?
io.quarkus:quarkus-vertx-http (Maven) ECOSYSTEM:introduced=0,fixed=3.20.6.1; Quarkus < 3.20.6.1, < 3.27.3.1, < 3.33.1.1, < 3.35.1.1, < 3.34.7, < 3.35.2; Quarkus Vert.x HTTP < 3.20.6.1, >= 3.21.0, < 3.27.3.1, >= 3.30.0, < 3.33.1.1, >= 3.34.0, < 3.35.1.1; Red Hat Build of Apache Camel for Quarkus 4.14, 4.0.
Is there a fix for CVE-2026-39852?
Yes. io.quarkus:quarkus-vertx-http (Maven): upgrade to 3.20.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39852 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39852?
Check whether you run io.quarkus:quarkus-vertx-http (Maven), Quarkus, Quarkus Vert.x HTTP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.quarkus:quarkus-vertx-http (Maven): upgrade to 3.20.6.1 or later
    # set io.quarkus:quarkus-vertx-http to 3.20.6.1 in your pom.xml or build.gradle

Technical details

An authorization bypass exists in Quarkus due to a path-normalization inconsistency between the security layer and the RESTEasy Reactive routing layer. The security layer performs authorization checks on the raw URL path, which includes matrix parameters (e.g., /api/admin;anything), while the routing layer strips these parameters before matching endpoints. A remote, unauthenticated attacker can exploit this by appending a semicolon and arbitrary text to a request URL to bypass path-based security policies while still reaching the intended protected endpoint. The issue is addressed in Quarkus versions 3.20.6.1, 3.27.3.1, 3.33.1.1, and 3.35.1.1.

Affected products

  • Quarkus Quarkus Vert.x HTTP < 3.20.6.1, >= 3.21.0, < 3.27.3.1, >= 3.30.0, < 3.33.1.1, >= 3.34.0, < 3.35.1.1

Identifiers

  • CVE-2026-39852
  • GHSA-rc95-pcm8-65v9

Timeline

  • 2026-05-04: disclosed
  • 2026-05-04: advisory
  • 2026-05-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.