Interpretation Conflict in Quarkus - CVE-2026-19651
Published: September 2, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.
The vulnerability exists due to improper input mapping in SpringWebResteasyReactiveProcessor in quarkus-spring-web when processing @RequestHeader annotations on the quarkus-rest stack. A remote attacker can send a specially crafted request with query string parameters to disclose sensitive information and alter application behavior by supplying query string parameters that are treated as request headers.
Only the quarkus-spring-web extension on the quarkus-rest (RESTEasy Reactive) stack is affected; the classic RESTEasy stack is not affected.