{}

{}

{}

{"bugzilla": {"description": "quarkus-spring-web: quarkus-spring-web: Authorization bypass via URL query string manipulation", "id": "2517694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517694"}, "csaw": false, "cwe": "CWE-551", "details": ["A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-19651", "package_state": [{"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "quarkus-spring-web", "product_name": "Red Hat build of Quarkus"}], "public_date": "2026-08-31T11:29:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19651\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19651"], "statement": "Important: This flaw in quarkus-spring-web allows for an authorization bypass by incorrectly interpreting URL query string parameters as request headers. This could enable unauthorized access to resources or functionality within applications utilizing the affected component, elevating the risk to Important due to the potential for privilege escalation or data exposure.", "threat_severity": "Important"}