Executive brief
Quarkus, a popular Java framework for building cloud-native applications, contains a security flaw in how it handles web request paths. An attacker can use specially crafted web addresses (using encoded characters like semicolons or slashes) to trick the system into bypassing security checks. This could allow unauthorized users to access restricted data or private files that should be protected by the application's security policies.
Technical details
The vulnerability exists in the AbstractPathMatchingHttpSecurityPolicy component of Quarkus. The security layer uses Vert.x's normalizedPath(), which only decodes unreserved characters, while downstream handlers (like StaticHandlerImpl) perform full percent-decoding. This discrepancy allows attackers to bypass path-based authorization policies using encoded semicolons (%3B) to hide matrix parameters from the security layer, or encoded slashes (%2F) and backslashes (%5C) to access protected static resources. The root cause is that the security layer's path normalization does not align with the decoding behavior of the resource handlers. Patches are available in versions 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, and 3.37.0.
Affected products
- Quarkus Quarkus Vert.x HTTP < 3.20.6.2, >= 3.21.0.CR1, < 3.27.4.1, >= 3.28.0.CR1, < 3.33.2.1, >= 3.34.0.CR1, < 3.36.3, >= 3.37.0.CR1, < 3.37.0
Timeline
- 2026-06-17: disclosed
- 2026-06-19: advisory: NVD published date
- 2026-07-29: patched: GitHub Advisory updated with final patch details