CVE-2026-50559 Details
Description
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
A vulnerability in Quarkus HTTP path-based authorization can be exploited to bypass security policies. This issue affects versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2. The vulnerability allows encoded semicolons to smuggle matrix parameters past the security layer, and encoded slashes or backslashes to access protected static resources. The root cause lies in the security layer's normalization process, which fails to properly decode reserved characters, leading to mismatches that can be exploited.
Users can upgrade to Quarkus versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, or 3.20.6.2, which contain the necessary patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:26017 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:26018 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:26194 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:26586 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:34608 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:36820 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:48151 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:54435 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-50559 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2486959 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json | redhat-SADP | |
| https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | redhat-SADP |
| CWE-863 | Incorrect Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| quarkus quarkus | < 3.20.6.2 >= 3.21.0, < 3.27.4.1 >= 3.28.0, < 3.33.2.1 >= 3.34.0, < 3.36.3 |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |