CVE-2026-94451
Received Received - Intake

Improper Input Validation in Quarkus REST Data Panache

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: redhat-SADP

Description
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-94451
EUVD
EUVD-2026-97678

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat build of Quarkus *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Quarkus REST Data Panache, which automatically generates REST endpoints for data entities. The flaw allows endpoints to improperly validate the sort parameter provided by users. This could let attackers access unauthorized information or overload the system by forcing complex database operations, potentially causing a denial of service.

Detection Guidance

Detecting this vulnerability requires checking Quarkus REST Data Panache endpoints for improper sort parameter validation. Monitor application logs for unusual sorting queries or database load spikes. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive data they shouldn't see or slow down your system by making the database perform heavy sorting tasks. This might lead to performance issues or data leaks, depending on the system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance could be impacted if sensitive data is exposed or if systems fail to meet performance standards.

Mitigation Strategies

Apply patches or updates from Quarkus if available. Validate and sanitize all sort parameters in REST endpoints. Implement rate limiting to prevent abuse. Monitor database performance for abnormal queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart