CVE-2026-39852: Quarkus is a Java framework for building cloud-native applications

This month

HIGH 8.2REMOTEUPGRADE

CVE-2026-39852 is a high-severity flaw (CVSS 8.2) affecting quarkus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolo

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	8.2 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 58%)
CISA exploited list	No
Weakness	CWE-863, CWE-551
Published	2026-05-05
Last modified	2026-08-17

Publisher (CNA): GitHub, Inc. · Vendor: quarkus

Last updated 2026-08-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-05-05 21:16 UTCPublished CVE record published
2026-08-17 12:18 UTCUpdated Record last modified

quarkus quarkus UPGRADE

Affected: < 3.20.6.1 · >= 3.21.0 and < 3.27.3.1 · >= 3.28.0 and < 3.33.1.1 · >= 3.34.0 and < 3.34.7 · >= 3.35.0 and < 3.35.2

Fixed in: 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7, 3.35.2

Safe to downgrade to: a release before 3.21.0

1. Check installed version

apt-cache policy quarkus || rpm -q quarkus || quarkus --version

2. UPGRADE to 3.20.6.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade quarkus

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade quarkus

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 3.21.0 (Debian / Ubuntu)

apt-cache madison quarkus sudo apt install quarkus=<VERSION_BEFORE_3.21.0> sudo apt-mark hold quarkus

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list quarkus sudo dnf downgrade quarkus-<VERSION_BEFORE_3.21.0> sudo dnf versionlock add quarkus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-39852?

quarkus: upgrade to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7, 3.35.2. Exact commands for each OS are on this page.

Is CVE-2026-39852 being exploited?

CVE-2026-39852 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-39852 affect?

CVE-2026-39852 affects quarkus. Severity is high (CVSS 8.2). Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows

How urgent is CVE-2026-39852?

Priority 44/100. High severity; Remotely exploitable, no login, no user action

Software pages

Java vulnerabilities

Related CVEs

CVE-2026-50559 HIGH 7.5 UPGRADE Quarkus is a Java framework for building cloud-native applications

References

← Back to latest CVEs