CVE-2026-50559: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.37.0 - Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.36.3 - Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.33.2.1 - Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.33.3 - Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.27.4.1 - Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.27.5 - Upgrade
Upgrade
Quarkus HTTPto a version that resolves this vulnerability.Fixed in 3.20.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50559?
The severity of CVE-2026-50559 is rated as high with a score of 7.5.
What does CVE-2026-50559 exploit?
CVE-2026-50559 exploits authentication and authorization bypass via advanced path normalization vulnerabilities in Quarkus.
How do I fix CVE-2026-50559?
To fix CVE-2026-50559, upgrade to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, or 3.20.6.2 of Quarkus.
What type of applications are affected by CVE-2026-50559?
CVE-2026-50559 affects cloud-native applications built using the Quarkus framework.
Is CVE-2026-50559 related to matrix parameters?
Yes, CVE-2026-50559 allows bypassing of HTTP path-based authorization policies using encoded semicolons to smuggle matrix parameters.