Interpretation Conflict in Quarkus - CVE-2026-19651

 

Interpretation Conflict in Quarkus - CVE-2026-19651

Published: September 2, 2026


Vulnerability identifier: #VU146775
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-19651
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.

The vulnerability exists due to improper input mapping in SpringWebResteasyReactiveProcessor in quarkus-spring-web when processing @RequestHeader annotations on the quarkus-rest stack. A remote attacker can send a specially crafted request with query string parameters to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.

Only the quarkus-spring-web extension on the quarkus-rest (RESTEasy Reactive) stack is affected; the classic RESTEasy stack is not affected.


Affected software

Quarkus

How to mitigate CVE-2026-19651

Install security update from vendor's website.

Quarkus - addressed in versions 3.27.6, 3.33.4, 3.39.2, 3.40.0, 4.0.0

External References

Related Security Bulletins