io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests

A flaw was found in io.quarkus:quarkus-vertx-http. A remote attacker can exploit an authorization bypass vulnerability by including semicolons, also known as matrix parameters, in HTTP requests. This allows bypassing path-based HTTP security policies, enabling unauthorized access to protected...

io.debezium:debezium-server (2.0.0.alpha1), io.debezium:debezium-server-core (2.0.0.alpha1) +112 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.8.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.debezium:debezium-server 2.0.0.alpha1 - io.debezium:debezium-server-core 2.0.0.alpha1 -...

com.abavilla:fpi-framework-core (1.6.1), com.abavilla:fpi-framework-pom (1.6.1) +149 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.15.3.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-framework-core 1.6.1 - com.abavilla:fpi-framework-pom 1.6.1 -...

io.quarkiverse.neo4j:quarkus-neo4j-integration-tests (>=1.8.0, <=2.1.0), io.quarkiverse.omnifaces:quarkus-omnifaces (3.0.3) +119 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.15.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.neo4j:quarkus-neo4j-integration-tests =1.8.0, =2.1.0 -...

io.automatiko.addons:automatiko-cassandra-persistence-addon (0.21.0), io.automatiko.addons:automatiko-events-websocket-addon (0.21.0) +165 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.15.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.15.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.automatiko.addons:automatiko-cassandra-persistence-addon 0.21.0 -...

io.github.project-openubl:quarkus-xsender (>=4.0.0.beta1, <=4.0.0.beta4), io.github.project-openubl:quarkus-xsender-deployment (>=4.0.0.beta1, <=4.0.0.beta4) +119 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.14.2.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.github.project-openubl:quarkus-xsender =4.0.0.beta1, =4.0.0.beta1, =1.7.1, =2.0.0 and more...

com.abavilla:fpi-bot-api (>=1.2.0, <=1.4.2), com.abavilla:fpi-bot-api-core (>=1.2.0, <=1.3.1) +634 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.14.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.abavilla:fpi-bot-api =1.2.0, =1.2.0, =1.2.0, =1.3.2, =1.5.0, =1.5.0, =1.2.1, =1.2.1, =1.2....

io.quarkiverse.operatorsdk:quarkus-operator-sdk (5.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (5.0.0.beta1) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.14.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 5.0.0.beta1 -...

io.quarkus:quarkus-amazon-lambda-http (2.13.9.final), io.quarkus:quarkus-amazon-lambda-http-deployment (2.13.9.final) +80 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.9.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 2.13.9.final -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkiverse.cxf:quarkus-cxf (>=1.5.8, <=1.5.10), io.quarkiverse.cxf:quarkus-cxf-deployment (>=1.5.8, <=1.5.10) +454 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.5.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.cxf:quarkus-cxf =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8, =1.5.8,...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.9.38, <=1.20.1), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.9.38, <=1.20.1) +1794 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (>=3.0.0.alpha1, <=3.20.6)

io.quarkus:quarkus-vertx-http MAVEN version =3.0.0.alpha1, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.9.38, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.2, =0.0.1, =0.0.5 and more Source cves: CVE-2026-39852 Source advisory: OSV:GHSA-RC95-PCM8-65V9...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (0.8.42), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (0.8.42) +263 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.12.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test 0.8.42 -...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (0.8.41), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (0.8.41) +148 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.11.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.11.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test 0.8.41 -...

com.github.mcollovati:quarkus-hilla (>=1.0.0, <=1.0.1), io.quarkus:quarkus-amazon-lambda-http (2.16.10.final) +254 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.10.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.10.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - com.github.mcollovati:quarkus-hilla =1.0.0, =1.0.1 - io.quarkus:quarkus-amazon-lambda-http...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (0.8.40), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (0.8.40) +277 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.9.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test 0.8.40 -...

io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests (1.9.0), io.quarkiverse.reactivemessaging.http:quarkus-reactive-messaging-http (>=1.1.4, <=1.1.5) +227 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.8.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.amazonservices:quarkus-amazon-services-integration-tests 1.9.0 -...

io.apicurio:apicurio-registry-common (2.4.3.final), io.quarkiverse.artemis:quarkus-artemis-integration-tests-parent (2.1.1) +279 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.7.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.apicurio:apicurio-registry-common 2.4.3.final -...

ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test (>=0.8.38, <=0.8.39), ai.timefold.solver:timefold-solver-quarkus-devui-integration-test (>=0.8.38, <=0.8.39) +312 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.16.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.16.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - ai.timefold.solver:timefold-solver-quarkus-benchmark-integration-test =0.8.38, =0.8.38, =0.8.3...