Quarkus versions prior to 3.20.6.1 and other specified versions contain an authorization bypass vulnerability due to inconsistent handling of matrix parameters in HTTP request paths. The security layer performs authorization checks on the raw URL path, which retains semicolons and matrix parameters, while the RESTEasy Reactive routing layer strips these parameters before endpoint matching. This discrepancy allows an attacker to append semicolons and arbitrary text to a URL (e.g., /api/admin;anything) to bypass path-based authorization policies protecting endpoints like /api/admin. The issue is tracked as CWE-863 (Incorrect Authorization) and CWE-551 (Incorrect Behavior Order). The vulnerability has been addressed in the fixed versions listed, and Red Hat recommends mitigation by normalizing URL paths at the proxy or load balancer level to strip matrix parameters before authorization checks.

This vulnerability allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies, potentially granting unauthorized access to protected endpoints. The CVSS 4.0 base score is 8.8 (high severity), indicating a significant security impact with network attack vector, no required privileges or user interaction, and high impact on availability and low impact on integrity. There are no known exploits in the wild at this time.

A fix is available in Quarkus versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2. Users should upgrade to these fixed versions to remediate the vulnerability. Additionally, as a mitigation, configure a reverse proxy or load balancer in front of the Quarkus application to normalize incoming URL paths by stripping matrix parameters (semicolons) before requests reach the Quarkus security layer. Ensure that proxy configuration changes are tested and applied properly. This mitigation reduces the risk if upgrading immediately is not possible.