--- id: CVE-2026-50559 title: Quarkus is a Java framework for building cloud-native applications summary: >- Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolo… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-287 - CWE-863 - CWE-551 vendor: quarkus product: quarkus affected: - quarkus < 3.20.6.2 - 'quarkus >= 3.21.0, < 3.27.4.1' - 'quarkus >= 3.28.0, < 3.33.2.1' - 'quarkus >= 3.34.0, < 3.36.3' patched: - quarkus 3.36.3 published: '2026-06-19' updated: '2026-07-03' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50559' references: - url: >- https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v label: security-advisories@github.com - url: 'https://access.redhat.com/errata/RHSA-2026:26017' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26018' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26194' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:26586' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:34608' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-50559' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2486959' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-50559' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50559' - url: 'https://access.redhat.com/errata/RHSA-2026:48151' - url: 'https://access.redhat.com/errata/RHSA-2026:84734' - url: 'https://access.redhat.com/errata/RHSA-2026:36820' - url: 'https://access.redhat.com/errata/RHSA-2026:54435' tags: - nvd - csaf - vex - red-hat epss: 0.01023 epssPercentile: 0.63333 ingestedAt: '2026-07-03T14:03:37.110Z' --- ## Overview Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch. ## Affected - `quarkus < 3.20.6.2` - `quarkus >= 3.21.0, < 3.27.4.1` - `quarkus >= 3.28.0, < 3.33.2.1` - `quarkus >= 3.34.0, < 3.36.3` ## Remediation Upgrade past the affected range: - `quarkus 3.36.3` ## Vendor advisories - **RHSA-2026:48151** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48151) - **RHSA-2026:26586** · Red Hat · fixed in: Red Hat Build of Apache Camel 3.33.2.SP1 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26586) - **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734) - **RHSA-2026:36820** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.29 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36820) - **RHSA-2026:26194** · Red Hat · fixed in: Red Hat build of Quarkus 3.20.6.SP2 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26194) - **RHSA-2026:26018** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.4.SP1 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26018) - **RHSA-2026:26017** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.2.SP1 · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26017) - **RHSA-2026:34608** · Red Hat · fixed in: Streams for Apache Kafka 2.9.4 · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34608) - **RHSA-2026:54435** · Red Hat · fixed in: Streams for Apache Kafka 3.2.1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54435) - **Red Hat VEX** · Important · affected: OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Debezium 3, Red Hat Fuse 7 · no fix planned: Red Hat build of Debezium 3, Red Hat Fuse 7, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json)