IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.8Hoch

CVE-2026-39852Quarkus authorization bypass via semicolon path normalization inconsistency

quarkusio quarkus; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 Veröffentlicht: (vor 6 Monaten)

Beschreibung

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.

Schwachstellentyp (CWE): CWE-863CWE-551

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
amq streams 2.9 —
amq streams 3.2 —
apache camel hawtio 4.4 —
cryostat 4 —
quarkus 3.20 —
quarkus 3.27 —
quarkus quarkus < 3.20.6.1
quarkusio quarkus < 3.20.6.1, >= 3.27.3.0, < 3.27.3.1, >= 3.34.0, < 3.34.7, >= 3.35.0, < 3.35.2
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat HawtIO HawtIO 4.4.0 all versions
Red Hat OpenShift Serverless all versions
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 all versions
Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 all versions
Red Hat Red Hat build of Apicurio Registry 2 all versions
Red Hat Red Hat build of Apicurio Registry 3 all versions
Red Hat Red Hat build of Debezium 3 all versions
Red Hat Red Hat Build of Keycloak —
Red Hat Red Hat build of OptaPlanner 8 all versions
Red Hat Red Hat build of Quarkus 3.20.6.SP1 all versions
Red Hat Red Hat build of Quarkus 3.27.3.SP1 —
Red Hat Red Hat Fuse 7 —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack all versions
Red Hat Red Hat OpenShift AI (RHOAI) all versions
Red Hat Red Hat Process Automation 7 all versions
Red Hat Streams for Apache Kafka 2.9.4 all versions
Red Hat Streams for Apache Kafka 3.2.1 all versions

Referenzen und Patches

CPE-Treffer (NVD) (5)
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* < 3.20.6.1
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≥ 3.21.0 < 3.27.3.1
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≥ 3.28.0 < 3.33.1.1
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≥ 3.34.0 < 3.34.7
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* ≥ 3.35.0 < 3.35.2