CLEANSTART-2026-CY16294 Security fix for CVE-2026-39852 applied in: keycloak 26.3.5-r3, keycloak 26.4.10-r0, keycloak 26.4.11-r2, keycloak 26.5.6-r5, keycloak 26.6.1-r1

CVE-2026-39852 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by an authorization bypass vulnerability

Summary IBM Enterprise Build of Quarkus is affected by an authorization bypass vulnerability CVE-2026-39852 Vulnerability Details CVEID:CVE-2026-39852 DESCRIPTION: Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1,...

ai.pipestream:pipestream-server (>=0.7.23, <=0.7.24), ai.pipestream:pipestream-server-deployment (>=0.7.23, <=0.7.24) +272 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.34.0, <=3.34.6)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.24 - ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test 2.0.0 -...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.21.0, <=3.27.3)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +996 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.30.0, <=3.33.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.30.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.6, =0.1.10, =0.1.3, =0.1.3, =0.1.3, =0.1.5 - ai.pipestream:pipestream-engine 0.0.6 and more...

CVE-2026-39852

Summary of CVE-2026-39852 : Quarkus exposes an authorization bypass due to path normalization mismatch between the security layer and RESTEasy Reactive routing, which preserves semicolons (matrix parameters) in the raw URL while routing drops them for endpoint matching. This allows unauthenticate...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.5), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.5) +19 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.0.0.alpha1, <=3.20.6)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.0.0.alpha1, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.13 and more Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

io.apicurio:apicurio-registry-app (1.1.2.final), io.apicurio:apicurio-registry-common (1.1.2.final) +58 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.2.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.apicurio:apicurio-registry-app 1.1.2.final - io.apicurio:apicurio-registry-common 1.1.2.fina...

io.quarkiverse.githubapp:quarkus-github-app (1.2.1), io.quarkiverse.githubapp:quarkus-github-app-deployment (1.2.1) +638 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.4.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app 1.2.1 -...

io.quarkiverse.githubapp:quarkus-github-app (>=1.5.0, <=1.6.0), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.5.0, <=1.6.0) +111 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.5.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.6.0 -...

io.backpackcloud:fakeomatic (0.3.0), io.github.project-openubl:xml-builder-server-x (1.2.0.rc1) +68 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.5.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.backpackcloud:fakeomatic 0.3.0 - io.github.project-openubl:xml-builder-server-x 1.2.0.rc1 -...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.9.0), io.quarkiverse.reactivemessaging.http:quarkus-reactive-messaging-http (>=1.1.4, <=1.1.5) +227 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.8.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.9.0 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (>=0.22.0, <=0.23.0), io.automatiko.addons:automatiko-events-websocket-addon (>=0.22.0, <=0.23.0) +144 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon =0.22.0, =0.22.0, =0.22.0, =0.22.0...

com.abavilla:fpi-framework-core (1.6.2), com.abavilla:fpi-framework-pom (1.6.2) +124 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-framework-core 1.6.2 - com.abavilla:fpi-framework-pom 1.6.2 -...

com.abavilla:fpi-framework-core (1.6.1), com.abavilla:fpi-framework-pom (1.6.1) +149 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.15.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-framework-core 1.6.1 - com.abavilla:fpi-framework-pom 1.6.1 -...

io.quarkus:quarkus-rest-servlet (>=3.34.0.cr1, <=3.34.6), io.quarkus:quarkus-rest-servlet-deployment (>=3.34.0.cr1, <=3.34.6) +6 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-undertow (>=3.34.0.cr1, <=3.34.6)

io.quarkus:quarkus-undertow MAVEN version =3.34.0.cr1, =3.34.0.cr1, =3.34.0.cr1, =3.34.0.cr1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.8 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420253...

com.github.fmcejudo:quarkus-eureka (>=1.0.0, <=1.1.1), com.github.fmcejudo:quarkus-eureka-deployment (>=1.0.0, <=1.1.1) +78 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-undertow (>=3.0.0.alpha1, <=3.20.6)

io.quarkus:quarkus-undertow MAVEN version =3.0.0.alpha1, =1.0.0, =1.0.0, =2.0.0-alpha1, =2.4.1, =2.4.1, =2.0.0-alpha1, =2.4.1, =2.4.1, =2.0.0, =2.0.0, =24.0.0, =24.8.3, =9.2.3, =9.6.3 and more Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420253...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +996 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.30.0, <=3.33.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.30.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.6, =0.1.10, =0.1.3, =0.1.3, =0.1.3, =0.1.5 - ai.pipestream:pipestream-engine 0.0.6 and more...

br.com.labbs:quarkus-monitor-reactive (1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (1.0.4) +235 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.labbs:quarkus-monitor-reactive 1.0.4 - br.com.labbs:quarkus-monitor-reactive-deployment...

io.quarkiverse.cxf:quarkus-cxf (1.5.0.cr1), io.quarkiverse.cxf:quarkus-cxf-deployment (1.5.0.cr1) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.12.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.12.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 1.5.0.cr1 - io.quarkiverse.cxf:quarkus-cxf-deployment 1.5.0.cr1 -...