Catálogo de CVE

CVE-2026-39852

Quarkus is a Java framework for building cloud-native…

[Catálogo de CVE]

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected endpoints. The vulnerability arises because Quarkus's security layer performs authorization checks on the raw URL path, which preserves these matrix parameters. io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravidade
High · CVSS 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
MavenRelease not reportedio.quarkus:quarkus-vertx-http3.35.1.1Fixed[GHSA-RC95-PCM8-65V9]

Showing 1 fix observations. All 6 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
MavenRelease not reportedio.quarkus:quarkus-vertx-http3.35.1.1Fixed[GHSA-RC95-PCM8-65V9]
UnknownRelease not reportedquarkus3.20.6.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedquarkus3.27.3.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedquarkus3.33.1.1UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedquarkus3.34.7UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedquarkus3.35.2UnknownSource applicability is not establishedProvider not reported
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "quarkus",
      "fixed_version": "3.20.6.1",
      "applicability_unknown": true
    },
    {
      "name": "quarkus",
      "fixed_version": "3.27.3.1",
      "applicability_unknown": true
    },
    {
      "name": "quarkus",
      "fixed_version": "3.33.1.1",
      "applicability_unknown": true
    },
    {
      "name": "quarkus",
      "fixed_version": "3.34.7",
      "applicability_unknown": true
    },
    {
      "name": "quarkus",
      "fixed_version": "3.35.2",
      "applicability_unknown": true
    },
    {
      "name": "io.quarkus:quarkus-vertx-http",
      "ecosystem": "maven",
      "provider_url": "https://github.com/advisories/GHSA-rc95-pcm8-65v9",
      "fixed_version": "3.35.1.1",
      "provider_source": "github",
      "provider_record_id": "GHSA-RC95-PCM8-65V9",
      "provider_updated_at": "2026-08-13T15:33:52Z"
    },
    {
      "name": "quarkus",
      "ranges": [
        {
          "fixed": "3.35.2",
          "introduced": "3.35.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852",
      "fixed_version": "3.35.2",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-39852",
      "provider_updated_at": "2026-08-17T12:18:23.367"
    }
  ]
}

OpenFactory catalog packages

A associação de pacotes está em andamento.

Observado:

Referências

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]