com.dropchop.recyclone:recyclone-quarkus-extension (>=2.0.36, <=2.0.38), com.dropchop.recyclone:recyclone-quarkus-extension-deployment (>=2.0.36, <=2.0.38) +519 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.35.0, <=3.35.1)

io.quarkus:quarkus-vertx-http MAVEN version =3.35.0, =2.0.36, =2.0.36, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =25.1.0, =1.1.0, =1.1.0, =3.17.0, =3.18.0 - io.quarkiverse.asyncapi:quarkus-asyncapi-scanner 1.0.6 and more Source cves: CVE-2026-39852 Source advisory: MEND:CVE-2026-39852...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

Important: Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.3.SP1)

An update for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available RHBQ 3.27.3.SP1. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

Incorrect Authorization

Overview io.quarkus:quarkus-vertx-http is a Cloud Native, Linux Container First framework for writing Java applications. Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain...

io.quarkus:quarkus-amazon-lambda-http (1.13.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.13.0.cr1) +95 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.13.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.13.0.cr1 -...

com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha2), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (1.5.0-alpha2) +226 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.4.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base 1.5.0-alpha2 -...

com.blazebit:blaze-persistence-examples-quarkus-base (1.5.0-alpha3), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (1.5.0-alpha3) +77 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.4.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base 1.5.0-alpha3 -...

io.quarkus.extensions:quarkus-extension-catalog (>=1.0.0.alpha5, <=1.0.0.alpha12), io.quarkus:quarkus-amazon-lambda-http (1.5.0.cr1) +66 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.5.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus.extensions:quarkus-extension-catalog =1.0.0.alpha5, =1.0.0.alpha12 -...

com.blazebit:blaze-persistence-examples-quarkus-base (>=1.5.0-alpha4, <=1.5.0-alpha5), com.blazebit:blaze-persistence-examples-quarkus-testsuite-base (>=1.5.0-alpha4, <=1.5.0-alpha5) +249 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.5.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.blazebit:blaze-persistence-examples-quarkus-base =1.5.0-alpha4, =1.5.0-alpha4, =1.5.0-alpha...

io.backpackcloud:fakeomatic (0.3.0), io.github.project-openubl:xml-builder-server-x (1.2.0.rc1) +68 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.5.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.backpackcloud:fakeomatic 0.3.0 - io.github.project-openubl:xml-builder-server-x 1.2.0.rc1 -...

io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor (2.0.2), io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor-deployment (2.0.2) +124 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.micrometer.registry:quarkus-micrometer-registry-azure-monitor 2.0.2 -...

fr.lixbox.lixbox-cache:lixbox-cache-core (>=11.1.2.8, <=11.1.2.12), fr.lixbox.lixbox-cache:lixbox-cache-ui (>=11.1.2.8, <=11.1.2.12) +474 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.2.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - fr.lixbox.lixbox-cache:lixbox-cache-core =11.1.2.8, =11.1.2.8, =11.1.2.2, =11.1.2.2, =11.1.2.6,...

br.com.labbs:quarkus-monitor-reactive (1.0.4), br.com.labbs:quarkus-monitor-reactive-deployment (1.0.4) +235 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - br.com.labbs:quarkus-monitor-reactive 1.0.4 - br.com.labbs:quarkus-monitor-reactive-deployment...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.3.1), io.quarkiverse.cxf:quarkus-cxf (1.5.4) +127 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.3.1 -...

com.abavilla:fpi-framework-core (>=1.1.13, <=1.1.19), com.abavilla:fpi-framework-pom (>=1.1.13, <=1.1.19) +530 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-framework-core =1.1.13, =1.1.13, =1.1.19 -...

io.quarkiverse.cxf:quarkus-cxf (1.5.7), io.quarkiverse.cxf:quarkus-cxf-deployment (1.5.7) +151 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.4.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf 1.5.7 - io.quarkiverse.cxf:quarkus-cxf-deployment 1.5.7 -...

io.quarkiverse.cxf:quarkus-cxf (>=1.5.8, <=1.5.10), io.quarkiverse.cxf:quarkus-cxf-deployment (>=1.5.8, <=1.5.10) +454 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8,...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...