CVE-2026-94451: Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache
A vulnerability was found in Quarkus REST Data Panache where the sort query parameter is not properly validated on non paged collection endpoints. When a resource is explicitly configured with ResourceProperties paged equals false, the code generator ListMethodImplementor fails to apply the standard SortQueryParamValidator to the generated list method. This allows the underlying database engine to process arbitrary sort fields. An attacker can exploit this to perform side channel attacks to infer sensitive information or provide complex non indexed fields to force expensive sorting operations, leading to a denial of service.
Other sources
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.
— MITRE