Answer in brief
CVE-2026-39852 records a High severity (CVSS 8.2) missing auth vulnerability in Quarkus has Authentication/Authorization bypasses. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Answer in brief
CVE-2026-39852 records a High severity (CVSS 8.2) missing auth vulnerability in Quarkus has Authentication/Authorization bypasses. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Update io.quarkus:quarkus-vertx-http to 3.20.6.1; io.quarkus:quarkus-vertx-http to 3.27.3.1; io.quarkus:quarkus-vertx-http to 3.33.1.1; io.quarkus:quarkus-vertx-http to 3.35.1.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMissing Auth describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-39852 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| io.quarkus:quarkus-vertx-httpmaven | <3.20.6.1 | 3.20.6.1 |
| io.quarkus:quarkus-vertx-httpmaven | >=3.21.0,<3.27.3.1 | 3.27.3.1 |
| io.quarkus:quarkus-vertx-httpmaven | >=3.30.0,<3.33.1.1 | 3.33.1.1 |
| io.quarkus:quarkus-vertx-httpmaven | >=3.34.0,<3.35.1.1 | 3.35.1.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-39852 records a High severity (CVSS 8.2) missing auth vulnerability in Quarkus has Authentication/Authorization bypasses. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for io.quarkus:quarkus-vertx-http, io.quarkus:quarkus-vertx-http, io.quarkus:quarkus-vertx-http.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate io.quarkus:quarkus-vertx-http to 3.20.6.1; io.quarkus:quarkus-vertx-http to 3.27.3.1; io.quarkus:quarkus-vertx-http to 3.33.1.1; io.quarkus:quarkus-vertx-http to 3.35.1.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMissing Auth describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-39852 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| io.quarkus:quarkus-vertx-httpmaven | <3.20.6.1 | 3.20.6.1 |
| io.quarkus:quarkus-vertx-httpmaven | >=3.21.0,<3.27.3.1 | 3.27.3.1 |
| io.quarkus:quarkus-vertx-httpmaven | >=3.30.0,<3.33.1.1 | 3.33.1.1 |
| io.quarkus:quarkus-vertx-httpmaven | >=3.34.0,<3.35.1.1 | 3.35.1.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-39852 records a High severity (CVSS 8.2) missing auth vulnerability in Quarkus has Authentication/Authorization bypasses. The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for io.quarkus:quarkus-vertx-http, io.quarkus:quarkus-vertx-http, io.quarkus:quarkus-vertx-http.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardQuarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources. Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (`;`) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's [security layer](https://quarkus.io/guides/security-authorize-web-endpoints-reference) performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like `/api/admin;anything` to bypass policies protecting `/api/admin` while still routing to the protected endpoint. ### Impact This issue may lead to Authentication/Authorization bypasses. ### Credits This issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).
Quarkus version 3.32.4 is vulnerable to an authorization bypass issue (GHSL-2026-099), in which semicolons (matrix parameters) in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources. Unauthenticated or lower-privileged users can bypass HTTP path-based authorization policies by appending a semicolon (`;`) and arbitrary text to the request URL. The vulnerability arises from a path-normalization inconsistency: Quarkus's [security layer](https://quarkus.io/guides/security-authorize-web-endpoints-reference) performs authorization checks on the raw URL path (which preserves matrix parameters), whereas RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. This allows requests like `/api/admin;anything` to bypass policies protecting `/api/admin` while still routing to the protected endpoint. ### Impact This issue may lead to Authentication/Authorization bypasses. ### Credits This issue was discovered with the [GitHub Security Lab Taskflow Agent](https://github.com/GitHubSecurityLab/seclab-taskflow-agent) and manually verified by GHSL team members [@p- (Peter Stöckli)](https://github.com/p-) and [@m-y-mo (Man Yue Mo)](https://github.com/m-y-mo).