CVE-2026-50559: Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
(updated )
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.
References
- access.redhat.com/errata/RHSA-2026:26017
- access.redhat.com/errata/RHSA-2026:26018
- access.redhat.com/errata/RHSA-2026:26194
- access.redhat.com/errata/RHSA-2026:26586
- access.redhat.com/errata/RHSA-2026:34608
- access.redhat.com/errata/RHSA-2026:36820
- access.redhat.com/errata/RHSA-2026:48151
- access.redhat.com/security/cve/CVE-2026-50559
- bugzilla.redhat.com/show_bug.cgi?id=2486959
- github.com/advisories/GHSA-qcxp-gm7m-4j5v
- github.com/quarkusio/quarkus/commit/919b80017d85564143a845b38e9cca54aff5b3cc
- github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v
- nvd.nist.gov/vuln/detail/CVE-2026-50559
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json
Code Behaviors & Features
Detect and mitigate CVE-2026-50559 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →