Riskcovery

CVE-2026-50559

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

State
Published
Severity
7.5 High
Published
Jun 19, 2026
Updated
Aug 13, 2026
Reserved
Jun 4, 2026

Read the record on cve.org

Description

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NGitHub_M
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nredhat-SADP

Weaknesses

  • CWE-287 Improper Authentication
  • CWE-863 Incorrect Authorization
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected Products

ProductVersions
quarkusquarkusio
  • >= 3.36.0, < 3.36.3Affected
  • >= 3.33.0, < 3.33.2.1Affected
  • >= 3.27.0, < 3.27.4.1Affected
  • < 3.20.6.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.