NES for Quarkus 2.16.x Release Notes

Security Fixes

• PathMatchingHttpSecurityPolicy no longer allows an aggressively normalized permit path to bypass the policy for the router path (CVE-2026-87743).

Security Fixes

• EvalSectionHelper can no longer emit unescaped evaluated data after losing the parent template's content-type variant (CVE-2026-93432).

Security Fixes

• DefaultTokenIntrospectionUserInfoCache can no longer reuse token introspection or UserInfo entries across OIDC tenants that present the same access token (CVE-2026-19625).
• ReflectionValueResolver can no longer reach unsafe Class, ClassLoader, or java.lang.reflect methods from template expressions (CVE-2026-12894).
  • Qute no longer registers the {#eval} section helper by default; build-time template validation does not flag it, so a template that uses {#eval} fails at render time unless the application registers EvalSectionHelper.Factory from an @Observes EngineBuilder method.
• SpringWebResteasyReactiveProcessor can no longer bind Spring @RequestHeader parameters from URL query-string values (CVE-2026-19651).

Security Fixes

• Authorization bypass for JAX-RS endpoint methods declared in an abstract class or customized by extensions through the annotation processor, which were not covered by quarkus.security.jaxrs.deny-unannotated-endpoints or quarkus.security.jaxrs.default-roles-allowed enforcement (CVE-2023-5675).
• Denial of service from security checks on some RESTEasy Reactive endpoints being performed after serialization, letting requests to those endpoints consume excessive processing resources (CVE-2024-1726).
• Authorization bypass in HTTP path-based security policy matching via encoded semicolons that smuggle matrix parameters past the security layer, and encoded slashes or backslashes that reach protected static resources (CVE-2026-50559).

Notes

• This release originates from the open‑source Quarkus repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds, together with the backported security fixes listed below.

Security Fixes

• Leak of local build-time configuration (environment variables and system properties) into recorded runtime defaults (CVE-2024-2700).
• Authentication bypass via the default WebAuthn callback endpoint being registered even for applications with custom endpoints (CVE-2024-12225).
• Denial of service from leaked response buffers in RESTEasy Classic when client connections end early (CVE-2025-1634).
• Denial of service from worker threads blocking indefinitely on a full write queue in RESTEasy Reactive (CVE-2025-66560).
• Authorization bypass via matrix parameters in HTTP path-based security policy matching (CVE-2026-39852).