quarkusio vulnerabilities

Products

• quarkus 4

Latest quarkusio CVEs

Newest publication first

1. CVE-2026-50559 Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

   Published 2026-06-19

   High·CVSS 7.5 EPSS 1.0%

   Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past...

2. CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency

   Published 2026-05-05

   High·CVSS 8.8 EPSS 0.71%

   Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged user...

3. CVE-2025-66560 Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write

   Published 2026-01-07

   High·CVSS 7.5 EPSS 0.38%

   Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exists in the HTTP layer of Quarkus REST related to response handling. When a response is being written, the framework waits f...

4. CVE-2025-49574 Quarkus potential data leak when duplicating a duplicated context

   Published 2025-06-23

   Medium·CVSS 6.4 EPSS 0.28%

   Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated context to implement c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.