High

Quarkus has Authentication/Authorization bypasses

Disclosed: 04.05.2026
Updated: 11.10.2026 13:20

Quarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources.

Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (;) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's security layer performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like /api/admin;anything to bypass policies protecting /api/admin while still routing to the protected endpoint.

Impact

This issue may lead to Authentication/Authorization bypasses.

Credits

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	io.quarkus:quarkus-vertx-http	< 3.20.6.1, >= 3.21.0, < 3.27.3.1, >= 3.30.0, < 3.33.1.1, >= 3.34.0, < 3.35.1.1	3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1

References

CVSS score 8.2/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness (CWE): CWE-287, CWE-551, CWE-863
Platform: Java / Kotlin (Maven)
Package: io.quarkus:quarkus-vertx-http
Disclosed: 04.05.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-rc95-pcm8-65v9 - CC BY 4.0

Vulnerability history: io.quarkus:quarkus-vertx-http

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 5
First → latest: 12.2022 07.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 4
Medium 1

Disclosures per year

2022: 1
2023: 2
2024: 0
2025: 0
2026: 2

29.07.2026

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

High · 7.5 CVE-2026-50559 < 3.20.6.2, >= 3.21.0.CR1, < 3.27.4.1, >= 3.28.0.CR1, < 3.33.2.1, >= 3.34.0.CR1, < 3.36.3, >= 3.37.0.CR1, < 3.37.0 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0
04.05.2026

Quarkus has Authentication/Authorization bypasses this entry

High · 8.2 CVE-2026-39852 < 3.20.6.1, >= 3.21.0, < 3.27.3.1, >= 3.30.0, < 3.33.1.1, >= 3.34.0, < 3.35.1.1 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1
20.09.2023

Quarkus HTTP vulnerable to incorrect evaluation of permissions

High · 8.1 CVE-2023-4853 < 2.16.11.Final, >= 3.0.0, < 3.2.6.Final, >= 3.3.0, < 3.3.3 2.16.11.Final, 3.2.6.Final, 3.3.3
23.02.2023

Cross-site Scripting in Quarkus

Medium · 6.1 CVE-2023-0044 < 2.13.7.Final 2.13.7.Final
06.12.2022

Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed

High · 7.5 CVE-2022-4147 >= 2.14.0.CR1, < 2.14.2.Final, < 2.13.5.Final 2.14.2.Final, 2.13.5.Final

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application