CVE-2026-50559
Full vulnerability record from the local CVENow database.
Description
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-06-19 21:17:02.373000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-50559",
"sourceIdentifier": "[email protected]",
"published": "2026-06-19T21:17:02.373",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch."
},
{
"lang": "es",
"value": "Quarkus es un framework Java para construir aplicaciones nativas de la nube. Antes de las versiones 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5 y 3.20.6.2, las políticas de autorización basadas en rutas HTTP de Quarkus pueden ser eludidas utilizando puntos y coma codificados (%3B) para introducir parámetros de matriz más allá de la capa de seguridad, y utilizando barras diagonales codificadas (%2F) o barras invertidas (%5C) para acceder a recursos estáticos protegidos. Este es un problema distinto de CVE-2026-39852, que abordó solo la eliminación literal de puntos y coma. Las versiones 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5 y 3.20.6.2 contienen un parche."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "quarkusio",
"product": "quarkus",
"versions": [
{
"version": ">= 3.36.0, < 3.36.3",
"status": "affected"
},
{
"version": ">= 3.33.0, < 3.33.2.1",
"status": "affected"
},
{
"version": ">= 3.27.0, < 3.27.4.1",
"status": "affected"
},
{
"version": "< 3.20.6.2",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Cryostat 4 on RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cryostat/cryostat-reports-rhel9",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"versions": [
{
"version": "4.2.0-13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cryostat 4 on RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cryostat/cryostat-rhel9",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"versions": [
{
"version": "4.2.0-13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cryostat 4 on RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "cryostat/jfr-datasource-rhel9",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"versions": [
{
"version": "4.2.0-13",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus",
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.33"
],
"versions": [
{
"version": "vertx-http",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.20.6.SP2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus",
"cpes": [
"cpe:/a:redhat:quarkus:3.20::el8"
],
"versions": [
{
"version": "vertx-http",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.27.4.SP1",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"versions": [
{
"version": "vertx-http",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.33.2.SP1",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus",
"cpes": [
"cpe:/a:redhat:quarkus:3.33::el8"
],
"versions": [
{
"version": "vertx-http",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 2.9.4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
],
"versions": [
{
"version": "vertx-http",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/multicluster-redirector-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"versions": [
{
"version": "1782989027",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
"cpes": [
"cpe:/a:redhat:serverless:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apicurio Registry 3",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Debezium 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:debezium:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-trustyai-service-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "streams for Apache Kafka 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "quarkus-vertx-http",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-22T17:29:52.634980Z",
"id": "CVE-2026-50559",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
},
{
"lang": "en",
"value": "CWE-863"
}
]
},
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-551"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.20.6.2",
"matchCriteriaId": "3E37C5F3-9057-44CE-A42A-71BD38827241"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.21.0",
"versionEndExcluding": "3.27.4.1",
"matchCriteriaId": "D726AC73-94BB-4DC6-A13F-52E7A93DC593"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.28.0",
"versionEndExcluding": "3.33.2.1",
"matchCriteriaId": "DAAA66C6-B4F8-4517-A4FF-F3F831BEAF0F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.34.0",
"versionEndExcluding": "3.36.3",
"matchCriteriaId": "6E73505E-C605-42F6-B9A1-E9BDFF0090D8"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26017",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26018",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26194",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26586",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34608",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36820",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:48151",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54435",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50559",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486959",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}