{"action":"Upgrade io.quarkiverse.openapi.generator:quarkus-openapi-generator to 2.16.0-lts (2.16.x) or 2.17.0 (2.17.x) or later.","affected":[{"fixed":"2.16.0-lts","introduced":"0"},{"fixed":"2.17.0","introduced":"2.16.0"}],"component":"io.quarkiverse.openapi.generator:quarkus-openapi-generator","cve_ids":["CVE-2026-42333"],"ecosystem":"Maven","epss":0.004,"exploited":false,"fixed_versions":["2.16.0-lts","2.17.0"],"ghsa_id":"GHSA-fr8f-rwjx-f32v","id":"tcs_01M5N8WMGWG9JECADX5M0A6J9G","modified_at":"2026-05-13T13:56:04.796279Z","published_at":"2026-05-04T21:15:55Z","references":["https://osv.dev/vulnerability/GHSA-fr8f-rwjx-f32v","https://github.com/quarkiverse/quarkus-openapi-generator/security/advisories/GHSA-fr8f-rwjx-f32v","https://nvd.nist.gov/vuln/detail/CVE-2026-42333","https://github.com/quarkiverse/quarkus-openapi-generator/pull/1586","https://github.com/quarkiverse/quarkus-openapi-generator","https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.11.1-lts","https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.16.0-lts","https://github.com/quarkiverse/quarkus-openapi-generator/releases/tag/2.17.0"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-fr8f-rwjx-f32v","url":"https://osv.dev/vulnerability/GHSA-fr8f-rwjx-f32v"},{"source":"nvd","source_id":"CVE-2026-42333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42333"}],"summary":"quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations"}