Quarkus Authorization Bypass (CVE-2026-39852): The Fix That 50+ EOL Versions Will Never Get
There is a high-severity authorization bypass in Quarkus, the Java framework built for cloud-native and Kubernetes workloads. CVE-2026-39852 (CVSS 8.2) is a path-normalization inconsistency between Quarkus's security layer and its routing layer: the security check evaluates the raw URI while routing normalizes it, so a crafted path can walk past HTTP path-based authorization policies and reach endpoints the policy says are protected — without credentials.
Fixes exist. Per the NVD advisory, patched builds shipped for six release lines: 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7, 3.35.1.1, and 3.35.2.
Here is the part the security write-ups mostly skip: we track 58 Quarkus release lines, and 55 of them are past end of life. Only 3.38 (current), 3.33 (LTS, supported to March 25, 2027), and 3.27 are supported today. For every other line — including the entire 2.x family — there is not going to be a patched build. Not for this CVE, not for the next one.
Why so many Quarkus versions are EOL
This is not neglect by the Quarkus team — it is the release model. Quarkus ships minors fast, and a regular minor is effectively superseded the moment its successor lands, often within about a month: 3.34 reached EOL on May 1, 2026; 3.35 on May 27; 3.36 on June 24; 3.37 on July 29. The durable windows belong to the designated LTS lines — 3.20 LTS's community window closed March 28, 2026, and 3.33 LTS runs to March 2027.
Fast release trains are great for the framework and rough on enterprises, because enterprises pin. The version in your build file is whatever your platform team standardized on last year. A 2024-era Quarkus service that "just works" is, by the community calendar, several generations past its last security fix.
The 2.x family: end of the line, permanently
The last 2.x line, Quarkus 2.16, reached community end of life on October 31, 2023 — its final build was 2.16.12. Every 2.x release predates this vulnerability's fix by years and will never receive it. Third-party vendors do sell extended support with security patches for Quarkus 2.x and out-of-window 3.x lines, which is the only way a pinned 2.x deployment gets a fix for a flaw like this one; the alternative is the migration to 3.x with its Jakarta namespace change — a real project, not a version bump.
Fixed vs. stranded
| Where you are | Status | Your move |
|---|---|---|
| 3.35.2+, 3.38 (current) | Fixed & supported | Update normally |
| 3.33 LTS | Fixed in 3.33.1.1 · supported to Mar 2027 | Patch to 3.33.1.1+ |
| 3.27 | Fixed in 3.27.3.1 | Patch, plan move to LTS |
| 3.20 LTS | Fix exists (3.20.6.1) · community window closed Mar 28, 2026 | Apply fix, migrate to 3.33 LTS |
| Any other 3.x minor | EOL — no fixed build in your line | Upgrade to a fixed line |
| Any 2.x | EOL since 2023 or earlier — no fix, ever | Migrate or extended support |
Full version-by-version dates, risk scores, and the live support status are on our Quarkus lifecycle page — or paste your dependency file into the stack scanner and it will tell you which side of the table you're on.
The bigger pattern
This is the third time in a week the same story has played out with different names in it: N-able N-central shipped a fix that legacy consoles must migrate to receive, JsonPath's only patched line is its newest, and now Quarkus ships a fix that 55 of 58 release lines can't take. Vulnerability management assumes a patch exists; lifecycle reality frequently says otherwise. That gap — between "a fix was released" and "a fix was released for what you run" — is exactly what EOL tracking exists to close, before a CVE does it for you.
Frequently Asked Questions
Which Quarkus versions are fixed against CVE-2026-39852?
Per NVD: 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.34.7, 3.35.1.1, and 3.35.2 and later. Lines without a listed fixed version — all of 2.x and most 3.x minors — have no patched build.
Is Quarkus 2.x still supported?
No. Quarkus 2.16, the last 2.x line, reached community EOL on October 31, 2023 (final release 2.16.12). No 2.x fix for this or future CVEs will come from the community project. Commercial extended support for 2.x exists from third-party vendors.
How long is a Quarkus version supported?
Regular minors are superseded when the next minor ships — often within about a month. LTS lines get longer windows; 3.33 LTS runs to March 25, 2027. Of 58 tracked release lines, 3 are supported today.
What should I do on an EOL Quarkus version?
Upgrade to a fixed, supported line; buy extended support so patches keep coming for the line you're pinned to; or document accepted risk with compensating controls while you migrate. Note that normalization-based authorization bypasses are hard to reliably filter at a proxy — edge rules are a stopgap, not a fix.