{"id":"CVE-2026-50559","summary":"Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities","details":"Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.","aliases":["GHSA-qcxp-gm7m-4j5v"],"modified":"2026-10-30T02:47:39.263439223Z","published":"2026-06-19T20:26:39.322Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50559.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-287","CWE-863"]},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26018"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26194"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26586"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-50559"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50559.json"},{"type":"ADVISORY","url":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50559"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486959"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/quarkusio/quarkus","events":[{"introduced":"0"},{"fixed":"60d7fe61668621e078554f72baddb1c8b7637eb5"},{"introduced":"15d328f8fabbae10e97c9ce38f30e4d8a1f104fc"},{"fixed":"0eaadde7b91a93fe1c0c75f7f321c6e6902d368b"},{"introduced":"d5a75b4753b4b8484043a09b835e98514c1aae0b"},{"fixed":"d605e1d1a7df0f696a6de00fb2263c345aa66879"},{"introduced":"b2cd17b06b5d1aefd9422c8aff38d6281e93d12e"},{"fixed":"b3e73ed922545bd281545613bf42af798fd51d3e"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"3.20.6.2"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*","range":[{"introduced":"3.21.0"},{"fixed":"3.27.4.1"}]},{"cpe":"cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*","range":[{"introduced":"3.28.0"},{"fixed":"3.33.2.1"}],"source":"CPE_RANGE"},{"cpe":"cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*","range":[{"introduced":"3.34.0"},{"fixed":"3.36.3"}],"source":"CPE_RANGE"}]}}],"versions":["3.20.6"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50559.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}