CVE-2026-50559

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

HIGH

7.5

CVSS Score

Published: June 19, 2026 at 08:26 PM UTC

Updated: October 25, 2026 at 11:10 PM UTC

9 products affected across 3 vendorsQuarkusQuarkusOpenShift AI

Using quarkus by quarkusio?

Get instant alerts when new vulnerabilities affect quarkus - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1%

SSVC

PoC

Description

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Quarkus · Quarkus

95%

v < 3.20.6.23.21.0 ≤ v < 3.27.4.13.28.0 ≤ v < 3.33.2.13.34.0 ≤ v < 3.36.3

Affected range stops below 3.20.6.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.27.4.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.33.2.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.36.3, so it looks safe — our inference, not a vendor statement

Quarkus · Quarkusio

90%

v < 3.20.6.2

Affected range stops below 3.20.6.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.27.4.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.33.2.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.36.3, so it looks safe — our inference, not a vendor statement

Build of Apache Camel for Quarkus · Red Hatrpm

60%

Build of Apache Camel - HawtIO · Red Hatrpm

60%

Build of Debezium · Red Hatrpm

60%

Fuse · Red Hatrpm

60%

OpenShift AI · Red Hatcontainer

60%

All versions

OpenShift Serverless · Red Hatrpm

60%

All versions

Streams for Apache Kafka · Red Hatrpm

60%

Vendor states this is fixed in vertx-http (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v