CVE-2026-94451 Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-94451

The Quarkus REST Data Panache component is vulnerable to information disclosure and denial of service (DoS) due to an unvalidated sort parameter . An attacker can exploit this flaw on certain endpoints to gain unauthorized access to information or force the database to perform complex tasks, pote...

io.quarkus.extensions:quarkus-extension-catalog (>=1.0.0.alpha5, <=1.0.0.alpha12), io.quarkus:quarkus-hibernate-orm-rest-data-panache (1.5.0.cr1) +19 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (1.5.0.cr1)

io.quarkus:quarkus-resteasy MAVEN version 1.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus.extensions:quarkus-extension-catalog =1.0.0.alpha5, =1.0.0.alpha12 -...

io.quarkus:quarkus-hibernate-orm-rest-data-panache (2.2.4.final), io.quarkus:quarkus-hibernate-orm-rest-data-panache-deployment (2.2.4.final) +23 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.2.4.final)

io.quarkus:quarkus-resteasy MAVEN version 2.2.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-hibernate-orm-rest-data-panache 2.2.4.final -...

io.quarkus:quarkus-hibernate-orm-rest-data-panache (2.0.2.final), io.quarkus:quarkus-hibernate-orm-rest-data-panache-deployment (2.0.2.final) +23 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.0.2.final)

io.quarkus:quarkus-resteasy MAVEN version 2.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-hibernate-orm-rest-data-panache 2.0.2.final -...

io.quarkus:quarkus-hibernate-orm-rest-data-panache (2.1.2.final), io.quarkus:quarkus-hibernate-orm-rest-data-panache-deployment (2.1.2.final) +95 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.1.2.final)

io.quarkus:quarkus-resteasy MAVEN version 2.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkus:quarkus-hibernate-orm-rest-data-panache 2.1.2.final -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk-integration-tests (2.0.0.beta2), io.quarkiverse.operatorsdk:quarkus-operator-sdk-samples (2.0.0.beta2) +23 more potentially affected by CVE-2025-1634 via io.quarkus:quarkus-resteasy (2.0.1.final)

io.quarkus:quarkus-resteasy MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-resteasy and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk-integration-tests 2.0.0.beta2 -...