fr.lixbox.lixbox-param:lixbox-param-core (>=11.1.2.16, <=11.1.2.21), fr.lixbox.lixbox-param:lixbox-param-ui (>=11.1.2.16, <=11.1.2.21) +111 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.6.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.6.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - fr.lixbox.lixbox-param:lixbox-param-core =11.1.2.16, =11.1.2.16, =11.1.2.21 -...

br.com.labbs:quarkus-monitor-reactive (1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (1.0.4) +235 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.13.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.labbs:quarkus-monitor-reactive 1.0.4 - br.com.labbs:quarkus-monitor-reactive-deployment...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (0.8.41), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (0.8.41) +148 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.16.11.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test 0.8.41 -...

com.qwlabs.doraemon:graphql (>=0.1.2, <=0.1.8), io.debezium:debezium-server (>=1.8.0.cr1, <=1.8.1.final) +614 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (2.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.qwlabs.doraemon:graphql =0.1.2, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1, =1.8.0.cr1,...

io.kaoto.forage:camel-jbang-plugin-forage (1.5.0), org.apache.camel.quarkus:camel-quarkus-integration-test-http-grouped (>=3.35.0, <=3.36.0) +18 more potentially affected by CVE-2026-42527 via org.apache.camel:camel-vertx-http (>=4.19.0, <=4.20.0)

org.apache.camel:camel-vertx-http MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.20.0 and more Source cves: CVE-2026-42527 Source advisory:...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +1253 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-vertx-http MAVEN version =3.21.0.cr1, =0.1.0, =0.1.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =1.21.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.8 and more Source cves: CVE-2026-50559 Source advisory: MEND:CVE-2026-50559...

Path Equivalence

Overview io.quarkus:quarkus-vertx-http is a Cloud Native, Linux Container First framework for writing Java applications. Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP request...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +1139 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-vertx-http MAVEN version =3.28.0.cr1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.0.2, =0.0.18 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-173750...

com.dropchop.recyclone:recyclone-quarkus-extension (>=2.0.36, <=2.0.38), com.dropchop.recyclone:recyclone-quarkus-extension-deployment (>=2.0.36, <=2.0.38) +519 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.35.0, <=3.35.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.35.0, =2.0.36, =2.0.36, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =1.1.0, =1.1.0, =3.17.0, =3.18.0 - io.quarkiverse.asyncapi:quarkus-asyncapi-scanner 1.0.6 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

ai.pipestream:pipestream-server (>=0.7.23, <=0.7.24), ai.pipestream:pipestream-server-deployment (>=0.7.23, <=0.7.24) +272 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.34.0, <=3.34.6)

io.quarkus:quarkus-vertx-http MAVEN version =3.34.0, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.23, =0.7.24 - ai.timefold.solver.enterprise:timefold-solver-enterprise-quarkus-integration-test 2.0.0 -...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)

An update for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available RHBQ 3.27.3.SP1. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkiverse.apicurio:quarkiverse-apicurio-registry-client (0.0.1), io.quarkiverse.apicurio:quarkiverse-apicurio-registry-client-deployment (0.0.1) +370 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.10.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.10.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.apicurio:quarkiverse-apicurio-registry-client 0.0.1 -...

br.com.labbs:quarkus-monitor (>=0.1.5, <=0.3.0), br.com.labbs:quarkus-monitor-deployment (>=0.1.5, <=0.3.0) +84 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.9.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.labbs:quarkus-monitor =0.1.5, =0.1.5, =0.3.0 -...

io.dialob:quarkus-app (>=3.0.3, <=3.0.4), io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta4) +142 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.1.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.dialob:quarkus-app =3.0.3, =3.0.4 - io.quarkiverse.operatorsdk:quarkus-operator-sdk...

com.datastax.oss.quarkus:cassandra-quarkus-client (1.1.0), com.datastax.oss.quarkus:cassandra-quarkus-client-deployment (1.1.0) +620 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.datastax.oss.quarkus:cassandra-quarkus-client 1.1.0 -...

io.quarkiverse.githubapp:quarkus-github-app (>=1.1.2, <=1.1.3), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.1.2, <=1.1.3) +114 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.3 -...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.2), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.2) +124 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.2 -...