CVE-2026-39852: Quarkus-Vertx-HTTP Authentication/Authorization Bypass Vulnerability
Summary
CVE-2026-39852: Quarkus has Authentication/Authorization bypasses. Affects io.quarkus:quarkus-vertx-http across 4 version ranges.
< 3.20.6.1
>= 3.21.0, < 3.27.3.1
>= 3.30.0, < 3.33.1.1
>= 3.34.0, < 3.35.1.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Quarkus is a Kubernetes-native Java framework tailored for GraalVM and OpenJDK HotSpot, designed to create lightweight, high-performance applications. The 'quarkus-vertx-http' package provides reactive HTTP capabilities, allowing developers to build efficient web applications. However, a critical vulnerability has been identified in version 3.32.4, which can lead to unauthorized access to protected resources.
Vulnerability Detail
Quarkus version 3.32.4 is susceptible to an authorization bypass issue, where semicolons in HTTP requests can be exploited to bypass security constraints. This vulnerability arises from a path-normalization inconsistency between Quarkus's security layer and RESTEasy Reactive's routing layer. Unauthenticated or lower-privileged users can append a semicolon and arbitrary text to the request URL, allowing them to access protected endpoints without proper authorization checks. For example, a request like '/api/admin;anything' can bypass the security policies protecting '/api/admin'. This flaw may lead to significant security risks, including unauthorized access to sensitive data and resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.20.6.13.20.6.1 -
>= 3.21.0, < 3.27.3.13.27.3.1 -
>= 3.30.0, < 3.33.1.13.33.1.1 -
>= 3.34.0, < 3.35.1.13.35.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using semicolons in your HTTP request URLs until the package is updated. Additionally, consider implementing additional security measures, such as stricter input validation and monitoring for unauthorized access attempts.
Conclusion
The Quarkus-Vertx-HTTP package has a critical vulnerability (CVE-2026-39852) that allows unauthorized access due to an authorization bypass issue. It is essential to update to the patched versions to safeguard your applications. Additionally, consider using Vulert to monitor for vulnerabilities in your projects.
See every vulnerability recorded for io.quarkus:quarkus-vertx-http →
FAQ
CVE-2026-39852 is a vulnerability in the Quarkus framework that allows unauthorized access to protected resources due to an authorization bypass issue.
The vulnerability affects Quarkus version 3.32.4. It is recommended to update to versions 3.20.6.1, 3.27.3.1, 3.33.1.1, or 3.35.1.1 to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file, you can check for vulnerabilities without any installation.
The vulnerability may lead to unauthorized access to sensitive data and resources, posing significant security risks to applications using the affected Quarkus version.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.quarkus:quarkus-vertx-http.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
