---
id: CVE-2026-50559
title: Quarkus is a Java framework for building cloud-native applications
summary: >-
  Quarkus is a Java framework for building cloud-native applications. Prior to
  versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2,
  Quarkus HTTP path-based authorization policies can be bypassed using encoded
  semicolo…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-287
  - CWE-863
  - CWE-863
  - CWE-551
vendor: quarkus
product: quarkus
affected:
  - quarkus < 3.20.6.2
  - 'quarkus >= 3.21.0, < 3.27.4.1'
  - 'quarkus >= 3.28.0, < 3.33.2.1'
  - 'quarkus >= 3.34.0, < 3.36.3'
patched:
  - quarkus 3.36.3
published: '2026-06-19'
updated: '2026-07-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50559'
references:
  - url: >-
      https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:26017'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26018'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26194'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:26586'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:34608'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-50559'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2486959'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00667
epssPercentile: 0.5006
ingestedAt: '2026-07-03T14:03:37.110Z'
---

## Overview

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

## Affected

- `quarkus < 3.20.6.2`
- `quarkus >= 3.21.0, < 3.27.4.1`
- `quarkus >= 3.28.0, < 3.33.2.1`
- `quarkus >= 3.34.0, < 3.36.3`

## Remediation

Upgrade past the affected range:

- `quarkus 3.36.3`