CVE-2026-39852: GHSL-2026-099: Authorization Bypass in Quarkus - CVE-2026-39852

Quarkus is vulnerable to an authorization bypass issue where semicolons (matrix parameters) in HTTP requests can be used to bypass path-based HTTP security policies. The vulnerability arises because Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters.

When a path such as "/api/admin" is protected by a path-based HTTP security policy, sending a request like "/api/admin;anything" can bypass this policy while still routing to the protected endpoint unless the policy is configured to protect the exact "/api/admin;anything" path.

— Red Hat

Quarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources.

Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (;) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's security layer performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like /api/admin;anything to bypass policies protecting /api/admin while still routing to the protected endpoint.

Impact

This issue may lead to Authentication/Authorization bypasses.

Credits

This issue was discovered with the GitHub Security Lab Taskflow Agent and manually verified by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

— GitHub

Quarkus was vulnerable to an authorization bypass issue, where the use of semicolons in HTTP requests can improperly bypass security constraints, potentially allowing unauthorized access to protected resources.

— GitHub Security Lab