Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-94451
Red Hat Red Hat build of Quarkus 3.27.6.redhat — Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U L N L 6.5 .0027 18.3 —
AFFECTED
Product Versions Fixed
Red Hat build of Quarkus 3.27.6.redhat unspecified 3.27.6.redhat-00004
Red Hat build of Quarkus 3.33.4.redhat unspecified 3.33.4.redhat-00004
Exploit Intelligence unspecified —
TIMELINE
Sep 21 Reserved by redhat
Oct 12 Published (CNA: redhat)
Oct 15 PATCH SHIPPED — CVE-2026-94451 (Red Hat build of Quarkus 3.27.6.redhat). Fixed in Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004.
Description
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| September 21, 2026 | Reserved | Reserved by redhat |
| October 12, 2026 | Published | Published (CNA: redhat) |
| October 15, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-94451 (Red Hat build of Quarkus 3.27.6.redhat). Fixed in Red Hat build of Quarkus 3.27.6.redhat 3.27.6.redhat-00004. |
Affected
Affected products and packages — 3 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat build of Quarkus 3.27.6.redhat | — | — | 3.27.6.redhat-00004 |
| Red Hat | Red Hat build of Quarkus 3.33.4.redhat | — | — | 3.33.4.redhat-00004 |
| Red Hat | Exploit Intelligence | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-94451 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
