CVE-2026-50559
EUVD-2026-3808419.06.2026, 21:17
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| quarkus | quarkus | 𝑥 < 3.20.6.2 |
| quarkus | quarkus | 3.21.0 ≤ 𝑥 < 3.27.4.1 |
| quarkus | quarkus | 3.28.0 ≤ 𝑥 < 3.33.2.1 |
| quarkus | quarkus | 3.34.0 ≤ 𝑥 < 3.36.3 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-13 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-13 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-13 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 | vertx-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.20.6.SP2 | vertx-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.27.4.SP1 | vertx-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.33.2.SP1 | vertx-http ≤ 𝑥 < * | ADP |
| Red Hat | Streams for Apache Kafka 2.9.4 | vertx-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 | 1782989027 ≤ 𝑥 < * | ADP |
Common Weakness Enumeration
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
References