Quarkus versions prior to 3.20.6.1 and other specified versions contain a vulnerability (CVE-2026-39852) where an attacker can bypass HTTP path-based authorization due to inconsistent handling of matrix parameters (semicolons) between the security and routing layers. The security layer performs authorization checks on the raw URL path including matrix parameters, while the RESTEasy Reactive routing layer strips these parameters before matching endpoints. This discrepancy allows unauthorized access to protected endpoints by appending semicolons and arbitrary text to the URL path. The vulnerability is classified under CWE-863 (Incorrect Authorization) and CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization). The issue has been addressed in multiple fixed versions of Quarkus. Vendor advisory from Red Hat recommends mitigation by normalizing URL paths via reverse proxy or load balancer configuration to strip matrix parameters before authorization checks.

The vulnerability allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies, potentially granting unauthorized access to protected endpoints. The CVSS 4.0 score is 8.8 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability and low impact on integrity. There are no known exploits in the wild at this time.

A fix is available in Quarkus versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2. Users should upgrade to these fixed versions to remediate the vulnerability. Additionally, as an immediate mitigation, configure a reverse proxy or load balancer in front of the Quarkus application to normalize incoming URL paths by stripping matrix parameters (semicolons) before requests reach the Quarkus security layer. Ensure that any proxy configuration changes are thoroughly tested and applied properly. This mitigation reduces the risk until the application is updated.