Quarkus 2.16.x Release Notes

Bug Fixes

• Authorization bypass for JAX-RS endpoint methods declared in an abstract class or customized by extensions through the annotation processor, which were not covered by quarkus.security.jaxrs.deny-unannotated-endpoints or quarkus.security.jaxrs.default-roles-allowed enforcement (CVE-2023-5675).
• Denial of service from security checks on some RESTEasy Reactive endpoints being performed after serialization, letting requests to those endpoints consume excessive processing resources (CVE-2024-1726).
• Authorization bypass in HTTP path-based security policy matching via encoded semicolons that smuggle matrix parameters past the security layer, and encoded slashes or backslashes that reach protected static resources (CVE-2026-50559).

Notes

• This release originates from the open‑source Quarkus repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds, together with the backported security fixes listed below.

Bug Fixes

• Leak of local build-time configuration (environment variables and system properties) into recorded runtime defaults (CVE-2024-2700).
• Authentication bypass via the default WebAuthn callback endpoint being registered even for applications with custom endpoints (CVE-2024-12225).
• Denial of service from leaked response buffers in RESTEasy Classic when client connections end early (CVE-2025-1634).
• Denial of service from worker threads blocking indefinitely on a full write queue in RESTEasy Reactive (CVE-2025-66560).
• Authorization bypass via matrix parameters in HTTP path-based security policy matching (CVE-2026-39852).