CVE-2026-94451

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94451", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-09-21T16:58:44.547Z", "datePublished": "2026-10-12T16:26:59.851Z", "dateUpdated": "2026-10-15T23:41:42.312Z"}, "containers": {"cna": {"title": "Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.27.6.redhat", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "io.quarkus/quarkus-hibernate-orm-rest-data-panache", "defaultStatus": "affected", "versions": [{"version": "3.27.6.redhat-00004", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:quarkus:3.27::el8"]}, {"vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.33.4.redhat", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "packageName": "io.quarkus/quarkus-hibernate-orm-rest-data-panache", "defaultStatus": "affected", "versions": [{"version": "3.33.4.redhat-00004", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:quarkus:3.33::el8"]}, {"vendor": "Red Hat", "product": "Exploit Intelligence", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "exploit-intelligence/agent-client-rhel9", "defaultStatus": "unknown", "cpes": ["cpe:/a:redhat:exploit_intelligence:0"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:83082", "name": "RHSA-2026:83082", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:83520", "name": "RHSA-2026:83520", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-94451", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537516", "name": "RHBZ#2537516", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-12T16:05:51.278Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "Improper Input Validation", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-20: Improper Input Validation", "timeline": [{"lang": "en", "time": "2026-09-21T17:09:54.870Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-12T16:05:51.278Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-15T23:41:42.312Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T02:55:56.121203Z", "id": "CVE-2026-94451", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T02:56:08.403Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T02:55:56.121203Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T02:56:01.635Z"}}], "cna": {"title": "Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:quarkus:3.27::el8"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.27.6.redhat", "versions": [{"status": "unaffected", "version": "3.27.6.redhat-00004", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.quarkus/quarkus-hibernate-orm-rest-data-panache", "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:exploit_intelligence:0"], "vendor": "Red Hat", "product": "Exploit Intelligence", "packageName": "exploit-intelligence/agent-client-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-09-21T17:09:54.870Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-12T16:05:51.278Z", "value": "Made public."}], "datePublic": "2026-10-12T16:05:51.278Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:83082", "name": "RHSA-2026:83082", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-94451", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537516", "name": "RHBZ#2537516", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-15T18:19:10.732Z"}, "x_redhatCweChain": "CWE-20: Improper Input Validation"}}, "cveMetadata": {"cveId": "CVE-2026-94451", "state": "PUBLISHED", "dateUpdated": "2026-10-15T18:19:10.732Z", "dateReserved": "2026-09-21T16:58:44.547Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-12T16:26:59.851Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:quarkus:3.27::el8"], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-hibernate-orm-rest-data-panache", "product": "Red Hat build of Quarkus 3.27.6.redhat", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "3.27.6.redhat-00004", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html", "cpes": ["cpe:/a:redhat:quarkus:3.33::el8"], "defaultStatus": "affected", "packageName": "io.quarkus/quarkus-hibernate-orm-rest-data-panache", "product": "Red Hat build of Quarkus 3.33.4.redhat", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "3.33.4.redhat-00004", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:exploit_intelligence:0"], "defaultStatus": "unknown", "packageName": "exploit-intelligence/agent-client-rhel9", "product": "Exploit Intelligence", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service."}], "id": "CVE-2026-94451", "lastModified": "2026-10-16T00:17:07.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94451", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T02:55:56.121203Z", "version": "2.0.3"}}]}, "published": "2026-10-12T17:17:38.513", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:83082"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:83520"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-94451"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537516"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache", "id": "2537516", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537516"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-20", "details": ["Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service."], "name": "CVE-2026-94451", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Under investigation", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "quarkus-hibernate-orm-rest-data-panache", "product_name": "Red Hat build of Quarkus"}], "public_date": "2026-10-12T16:05:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94451\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94451"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires specific resource configurations to be exploitable. Successful exploitation allows an attacker to disclose sensitive information through side channel analysis or cause a denial of service by exhausting database resources. The vulnerability's root cause is a failure in the code generator to apply input validation to the sort parameter when paging is disabled.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.27.6.redhat-00004,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat build of Quarkus 3.27.6.redhat", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_quarkus", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[3.33.4.redhat-00004,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Red Hat build of Quarkus 3.33.4.redhat", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_quarkus", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Exploit Intelligence", "source": "cna", "vendor": "Red Hat"}, "product": "exploit_intelligence", "vendor": "redhat"}], "created": "2026-10-12T18:30:16.901194+00:00", "updated": "2026-11-03T16:37:59.116420+00:00", "vendors": ["redhat", "redhat$PRODUCT$build_of_quarkus", "redhat$PRODUCT$exploit_intelligence"]}