CVE-2026-39852

Executive Summary

CVE-2026-39852 is a critical authorization bypass vulnerability in the Quarkus Java framework, affecting versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2. The flaw arises from a path normalization inconsistency between Quarkus's security layer and its routing layer (RESTEasy Reactive). The security layer performs authorization checks on the raw URL path, preserving matrix parameters (semicolons), while the routing layer strips these parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass HTTP path-based authorization policies while still routing to the protected endpoint. This vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized in the wild.

Supply Chain & Package Security

This vulnerability affects the Quarkus framework, which is a Java-based, cloud-native application platform. It is distributed via Maven Central and other Java package repositories. Organizations using Quarkus in their supply chain should immediately audit their dependencies and update to patched versions. The vulnerability does not directly affect NPM, PyPI, Go, or Ruby packages, but it can impact any application built with vulnerable Quarkus versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to full compromise of the application's data and functionality.

Deep Dive & Mechanics

The root cause of CVE-2026-39852 is a path normalization inconsistency between two core components of Quarkus:

1. Security Layer: When performing authorization checks, the security layer uses the raw URL path as received by the server. This raw path preserves matrix parameters, which are delimited by semicolons (e.g., /api/admin;foo).

2. Routing Layer (RESTEasy Reactive): When routing the request to the appropriate endpoint, the routing layer strips matrix parameters from the path. This means that /api/admin;foo is normalized to /api/admin before endpoint matching.

This discrepancy allows an attacker to craft a URL that bypasses security checks (because the security layer sees a different path) but still reaches the intended protected endpoint (because the routing layer normalizes the path).

Example Attack:

• Protected endpoint: /api/admin
• Attacker request: GET /api/admin;evil
• Security layer sees: /api/admin;evil → Authorization check fails (if policy is based on exact path match) or passes (if policy is based on prefix match and the semicolon is not considered).
• Routing layer sees: /api/admin → Routes to the protected endpoint.

The vulnerability is particularly dangerous because it can be exploited without any authentication, and it bypasses common path-based access control mechanisms.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Security layer - uses raw path
String rawPath = request.getPath();
if (!authorizationService.isAuthorized(rawPath, user)) {
    throw new ForbiddenException();
}

// Routing layer - normalizes path
String normalizedPath = normalizePath(rawPath); // strips matrix parameters
Endpoint endpoint = router.route(normalizedPath);

Patched Code (Conceptual):

// Both layers use normalized path
String rawPath = request.getPath();
String normalizedPath = normalizePath(rawPath); // strips matrix parameters

if (!authorizationService.isAuthorized(normalizedPath, user)) {
    throw new ForbiddenException();
}

Endpoint endpoint = router.route(normalizedPath);

The patch ensures that both the security and routing layers use the same normalized path, eliminating the inconsistency.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a protected endpoint: Find an endpoint that requires authentication or specific privileges, e.g., /api/admin.

2. Craft the bypass URL: Append a semicolon and arbitrary text to the path, e.g., /api/admin;bypass.

3. Send the request: Use curl or any HTTP client to send a GET request to the crafted URL.

Example Exploit (curl):

curl -v "http://target.com/api/admin;bypass"

Expected Result: The request should be routed to the /api/admin endpoint without proper authorization.

Advanced Exploitation:

• Use Burp Suite or similar tools to automate the bypass.
• Combine with other techniques like path traversal or parameter pollution.

Blue Team

Detection Steps:

1. Monitor for semicolons in URL paths: Look for HTTP requests containing semicolons in the path component, especially targeting sensitive endpoints.

2. Analyze access logs: Check for patterns like /api/admin;* where the path after the semicolon is arbitrary.

3. Implement WAF rules: Block requests with semicolons in the path for sensitive endpoints.

Honeypot Setup:

• Deploy a fake /api/admin endpoint that logs all requests.
• Monitor for requests with semicolons in the path.

Indicators of Compromise (IOCs)

• URL Patterns: /*;* where the path contains a semicolon followed by arbitrary text.
• HTTP Requests: GET or POST requests to sensitive endpoints with semicolons in the path.
• Log Entries: Access logs showing paths like /api/admin;evil or /admin/panel;test.
• Network Traffic: Unusual requests to protected resources with matrix parameters.

Detection Engineering

YARA Rule

rule CVE_2026_39852_Quarkus_Path_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2026-39852 in Quarkus"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-39852"
    strings:
        $semicolon = /\/[^?]*;/
    condition:
        $semicolon
}

Sigma Rule

title: Quarkus Path Authorization Bypass via Matrix Parameters
id: cve-2026-39852
status: experimental
description: Detects HTTP requests with semicolons in the path, indicating exploitation of CVE-2026-39852
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: ';'
    condition: selection
falsepositives:
    - Legitimate use of matrix parameters in other contexts
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-39852 Quarkus Path Authorization Bypass";
    flow:to_server,established;
    content:";"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Quarkus: Upgrade to versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, or 3.35.2 (or later).
2. Apply WAF Rules: Block requests with semicolons in the path for sensitive endpoints.
3. Review Access Logs: Investigate any suspicious requests containing semicolons.

Long-Term Mitigations:

1. Implement Input Validation: Normalize paths before authorization checks.
2. Use Principle of Least Privilege: Ensure that even if bypassed, the impact is limited.
3. Regular Security Audits: Conduct code reviews and penetration testing.

Patch Verification:

• Check the Quarkus version in your application's dependencies.
• Verify that the path normalization is consistent across security and routing layers.

Valters IT

{/* [Security Hash: 8CFA205817655950A090D38C] */}