7.5
High
CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications
Description
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| quarkus 3.36 | 3.36.0 → < 3.36.3 | 3.36.3 |
| quarkus 3.33 | 3.33.0 → < 3.33.2.1 | 3.33.2.1 |
| quarkus 3.27 | 3.27.0 → < 3.27.4.1 | 3.27.4.1 |
| quarkus 3.20 | earliest → < 3.20.6.2 | 3.20.6.2 |
| Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 | Versions not published | |
| Red Hat build of Quarkus 3.20.6.SP2 | Versions not published | |
| Red Hat build of Quarkus 3.27.4.SP1 | Versions not published | |
| Red Hat build of Quarkus 3.33.2.SP1 | Versions not published | |
| Cryostat 4 | Versions not published |
Show the 15 other branches Hide the 15 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenShift Serverless | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat build of Debezium 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Streams for Apache Kafka 2.9.4 | Versions not published | |
| Red Hat OpenShift Dev Spaces 3.29 1782989027 | earliest → < 1782989027 | 1782989027 |
| Cryostat 4 on RHEL 9 4.2 | earliest → < 4.2.0-13 | 4.2.0-13 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of quarkus
The 4 CVEs of quarkus →
CVE-2026-39852
Quarkus is a Java framework for building cloud-native applications
8.8
High
CVE-2025-66560
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications
5.9
Medium
CVE-2025-49574
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications
6.4
Medium