Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.

### Technical Details

The security layer (AbstractPathMatchingHttpSecurityPolicy) normalizes request paths using Vert.x's normalizedPath(), which only decodes unreserved RFC 3986 characters (letters, digits, -, ., , ~). It then strips matrix parameters by looking for literal ; characters. This creates two mismatches:

1. Encoded semicolons (%3B): Since %3B is not decoded by normalizedPath(), the matrix parameter stripping in pathWithoutMatrixParams() never sees it. The encoded semicolon and everything after it become part of the path segment, causing policy matching to fail. This affects all path-policy-protected endpoints. 2. Static resource path mismatch: Static resource handlers (StaticHandlerImpl, FileSystemStaticHandler) perform full percent-decoding via URIDecoder.decodeURIComponent() and backslash-to-slash conversion before filesystem resolution. Reserved characters like %2F (slash) and %5C (backslash) that survive the security layer's partial decoding are fully decoded before file serving.

REST endpoints using Quarkus REST (RESTEasy Reactive) are not affected by the %2F/%5C vectors because the routing layer also uses normalizedPath() — both security and routing agree on the path, so no mismatch exists.

Attack Vectors

Encoded semicolon (matrix parameter smuggling), affects all path-policy-protected endpoints: - /api/admin%3Bbypass=true/data: security sees this as a single segment admin%3Bbypass=true, which does not match the /api/admin/ policy. The request passes through unauthenticated. - /api/secret%3b/data: same mechanism with lowercase hex digit.

Encoded slash/backslash on static resources, affects static files behind path policies: - /static-secret%2Fhtml, security does not match /static-secret.html policy; static handler decodes %2F to / and may resolve the file. - /static-secret%5Chtml . static handler decodes %5C to \, then converts to /.

Double encoding, affects static resources: - /secret%252Fconfidential.html, first decode by normalizedPath() turns %25 into %, producing %2F. Static handler's second decode turns %2F into /.

The following vectors were investigated and confirmed not exploitable:

- Unreserved character encoding (/api/adm%69n/data): normalizedPath() decodes these. Both security and routing see /api/admin/data. - Null byte injection (/api/admin%00/data): %00 is not decoded by normalizedPath(). - Encoded dot segments (/api/%2e%2e/secret/data): Period is unreserved, so %2e is decoded to . by normalizedPath(), then removeDots() normalizes .. segments. - REST endpoint bypass via %2F/%5C: Routing uses the same normalizedPath() as security. The encoded slash/backslash doesn't match any route.

Root Cause

pathWithoutMatrixParams() operates on the partially-decoded output of normalizedPath(), where reserved characters remain encoded. It searches for literal ; but never sees %3B. The fix (normalizePath()) performs full percent-decoding in a loop before stripping matrix parameters, removing null bytes, normalizing backslashes, and resolving dot segments, aligning the security layer's view of the path with what downstream handlers resolve.

Impact

- Unauthenticated access to endpoints protected by quarkus.http.auth.permission path-based policies via %3B smuggling - Static resource exposure by bypassing path policies on protected files via %2F/%5C - Applications using annotation-based security (@RolesAllowed, @Authenticated) on JAX-RS resources without path-based policies are not affected by the %2F/%5C vectors, but may still be affected by %3B if path policies coexist

Proof of Concept

# Encoded semicolon bypass — works on any path-policy-protected endpoint # Security sees "/api/admin%3Bbypass=true/data", doesn't match /api/admin/ policy curl -v http://target/api/admin%3Bbypass=true/data

# Encoded semicolon on authenticated endpoint curl -v http://target/api/secret%3b/data

# Static resource bypass via encoded slash (if static file behind path policy) curl -v http://target/static-secret%2Fhtml

# Static resource bypass via encoded backslash curl -v http://target/static-secret%5Chtml

Latest version: 3.39.2

The vulnerability in Quarkus REST arises when REST endpoints are implemented without a CDI scope and utilize field injection for request parameters. In such cases, a single instance of the endpoint class is shared across multiple concurrent requests, leading to the potential exchange of request parameters between these requests. This means that data such as HTTP headers, URI templates, cookies, and form values from one request can inadvertently be accessed by another, posing significant security risks.Affected applications should ensure proper scoping with @RequestScoped or avoid field injection for request parameters. The issue is fixed in version 3.18.2.

A vulnerability was found in quarkus-core component. Quarkus captures the local environment variables from the Quarkus namespace during the application's build. Thus, running the resulting application inherits the values captured at build time.

However, some local environment variables may have been set by the developer / CI environment for testing purposes, such as dropping the database during the application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application. It leads to dangerous behavior if the application does not override these values.

This behavior only happens for configuration properties from the quarkus. namespace. So, application-specific properties are not captured.

End of life: 8/27/2026, Latest version: 3.38.3

Quarkus is vulnerable to an authorization bypass issue where semicolons (matrix parameters) in HTTP requests can be used to bypass path-based HTTP security policies. The vulnerability arises because Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters.

When a path such as "/api/admin" is protected by a path-based HTTP security policy, sending a request like "/api/admin;anything" can bypass this policy while still routing to the protected endpoint unless the policy is configured to protect the exact "/api/admin;anything" path.

End of life: 7/29/2026, Latest version: 3.37.4

End of life: 6/24/2026, Latest version: 3.36.3

End of life: 5/27/2026, Latest version: 3.35.4

When a RestEasy Reactive JAX-RS endpoint has its methods with HTTP method annotations declared in the abstract Java class or when its methods without HTTP method annotations are customised by Quarkus extensions to handle JAX-RS GET requests using the annotation processor, then the authorization of these methods will not be enforced if it is enabled by either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or 'quarkus.security.jaxrs.default-roles-allowed' properties

So a combination of 2 factors triggers it: Users enable the security authorization of JAX-RS endpoints with either 'quarkus.security.jaxrs.deny-unannotated-endpoints' or quarkus.security.jaxrs.default-roles-allowed properties Users declare JAX-RS methods which must be secured with these properties in the Java abstract class which the JAX-RS endpoint class will extend

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.0, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement context propagation. With the new semantic data from one transaction can leak to the data from another transaction. From a Vert.x point of view, this new semantic clarifies the behavior. A significant amount of data is stored in the duplicated context, including request scope, security details, and metadata. Duplicating a duplicated context is rather rare and is only done in a few places. This issue has been patched in version 3.24.0.

End of life: 5/1/2026, Latest version: 3.34.7

End of life: 3/25/2027, Latest version: 3.33.3.2

End of life: 3/25/2026, Latest version: 3.32.4

End of life: 2/26/2026, Latest version: 3.31.4

End of life: 1/28/2026, Latest version: 3.30.8

A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not happen with configuration based security.

A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step ( that should at least be performed by default) in HTTPS and in http/2.

A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerability is availability.(incomplete fix for CVE-2021-3629)

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

End of life: 9/24/2026, Latest version: 3.27.5.2

Important: Red Hat build of Quarkus 3.20.1 release

Important: Red Hat build of Quarkus 3.15.4 release and security update

End of life: 3/28/2026, Latest version: 3.20.6.2

In Quarkus' RESTEasy Reactive component, usage of File.createTempFile() class in the FileBodyHandler class causes temp files to be created with -rw-r--r-- permissions.

Moderate: Red Hat build of Quarkus 3.15.3 release and security update

A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.

Critical: Red Hat build of Quarkus 3.8.6.SP1 Security Update

Critical: Red Hat build of Quarkus 3.2.12.SP1 Security Update

Moderate: Red Hat build of Quarkus 3.8.6 release and security update