Bug 2537516 (CVE-2026-94451)

Summary: CVE-2026-94451 quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ant, cescoffi, fmongiar, gsmet, jmartisk, manderse, olubyans, ozzy, pjindal, rguimara, sbiarozk, security-response-team, varjain
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-21 17:12:26 UTC 
A vulnerability was found in Quarkus REST Data Panache where the sort query parameter is not properly validated on non paged collection endpoints. When a resource is explicitly configured with ResourceProperties paged equals false, the code generator ListMethodImplementor fails to apply the standard SortQueryParamValidator to the generated list method. This allows the underlying database engine to process arbitrary sort fields. An attacker can exploit this to perform side channel attacks to infer sensitive information or provide complex non indexed fields to force expensive sorting operations, leading to a denial of service.