CVE-2026-50559High· 7.5▾ TwilightQuarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 1.0%
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
quarkus < 3.20.6.2quarkus >= 3.21.0, < 3.27.4.1quarkus >= 3.28.0, < 3.33.2.1quarkus >= 3.34.0, < 3.36.3Upgrade past the affected range:
quarkus 3.36.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39852High· 8.2Quarkus is a Java framework for building cloud-native applications
CVE-2025-66560Medium· 5.9Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications
CVE-2023-6394High· 7.4A flaw was found in Quarkus
CVE-2023-4853High· 8.1A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions
CVE-2026-12894High· 8.8A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails
CVE-2023-51767High· 7.0OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit