CVE-2026-50559: 
Java vulnerability analysis and mitigation

CVE-2026-50559 is an authentication/authorization bypass vulnerability in Quarkus, a Java framework for building cloud-native applications. The flaw allows unauthenticated attackers to bypass HTTP path-based authorization policies by using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and encoded slashes (%2F) or backslashes (%5C) to access protected static resources. It affects Quarkus versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, as well as numerous Red Hat products built on Quarkus. Published on June 17, 2026, it carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause lies in a path normalization mismatch within Quarkus's security layer (AbstractPathMatchingHttpSecurityPolicy), classified under CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization), CWE-863 (Incorrect Authorization), and CWE-287 (Improper Authentication). The security layer uses Vert.x's normalizedPath(), which only decodes unreserved RFC 3986 characters, and then strips matrix parameters by searching for literal ; characters — meaning %3B (encoded semicolon) is never decoded and thus never stripped, causing policy matching to fail. Additionally, static resource handlers (StaticHandlerImpl, FileSystemStaticHandler) perform full percent-decoding via URIDecoder.decodeURIComponent() and backslash-to-slash conversion, so reserved characters like %2F and %5C that survive the security layer's partial decoding are fully decoded before file serving, creating a second bypass vector. This is a distinct issue from CVE-2026-39852, which only addressed literal semicolon stripping. REST endpoints using Quarkus REST (RESTEasy Reactive) are not affected by the %2F/%5C vectors because routing and security both use normalizedPath() (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to access endpoints and static resources protected by quarkus.http.auth.permission path-based policies, resulting in a high confidentiality impact with no integrity or availability impact. Sensitive API endpoints and protected static files (e.g., configuration files, internal documents) can be exposed without any credentials. Applications relying solely on annotation-based security (@RolesAllowed, @Authenticated) on JAX-RS resources without path-based policies are not affected by the %2F/%5C vectors, but may still be vulnerable to %3B smuggling if path policies coexist (GitHub Advisory).

A proof-of-concept is publicly available in the official GitHub Security Advisory, which includes concrete curl commands demonstrating exploitation against real Quarkus deployments (GitHub Advisory). The vulnerability is automatable (no user interaction or privileges required) and exploitable over the network with low attack complexity. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.0025 (0.25%), and the vulnerability is not currently listed in the CISA KEV catalog (Red Hat CVE).

1. Reconnaissance: Identify internet-facing Quarkus applications using tools like Shodan or Censys, or by inspecting HTTP response headers (e.g., x-quarkus-*) to confirm Quarkus is in use and determine the version.
2. Identify protected endpoints: Map path-policy-protected API endpoints or static resources (e.g., /api/admin/*, /static-secret.html) through application enumeration or public documentation.
3. Encoded semicolon bypass (API endpoints): Craft a request with an encoded semicolon to smuggle a fake matrix parameter past the security layer:

   curl -v http://target/api/admin%3Bbypass=true/data
   curl -v http://target/api/secret%3b/data

   The security layer sees admin%3Bbypass=true as a single path segment that does not match the /api/admin/* policy, so the request passes unauthenticated.
4. Encoded slash/backslash bypass (static resources): Access protected static files using encoded path separators:

   curl -v http://target/static-secret%2Fhtml
   curl -v http://target/static-secret%5Chtml

   The security layer does not match the policy; the static handler decodes %2F to / or %5C to \ (then to /) and resolves the file.
5. Double-encoding bypass (static resources): Use double-encoded slashes for additional evasion:

   curl -v http://target/secret%252Fconfidential.html

   normalizedPath() decodes %25 to %, producing %2F; the static handler then decodes %2F to /.
6. Exfiltrate data: Review the response body for sensitive data from the protected endpoint or file (GitHub Advisory).

• Network: HTTP requests to path-policy-protected endpoints containing %3B, %3b, %2F, %2f, %5C, %5c, or %25 in the URL path; requests to static resource paths with encoded separators that would not normally appear in legitimate traffic.
• Logs: Web/access logs showing requests with percent-encoded semicolons or slashes in paths (e.g., /api/admin%3B, /static-secret%2F, /secret%252F) returning HTTP 200 responses to unauthenticated clients where 401/403 would be expected; repeated probing of multiple endpoints with these patterns may indicate automated scanning.
• Application Logs: Absence of authentication/authorization rejection log entries for requests that accessed protected resources, indicating the security layer was bypassed without triggering policy enforcement.

Upgrade Quarkus to one of the patched versions: 3.37.0, 3.36.3, 3.33.3, 3.33.2.1, 3.27.5, 3.27.4.1, or 3.20.6.2, depending on the current version branch in use. The fix introduces a normalizePath() function that performs full percent-decoding in a loop before stripping matrix parameters, removing null bytes, normalizing backslashes, and resolving dot segments — aligning the security layer's path view with what downstream handlers resolve. Red Hat has also released corresponding advisories (RHSA-2026:26017, RHSA-2026:26018, RHSA-2026:26194, RHSA-2026:26586) for affected Red Hat products including Red Hat build of Quarkus, Red Hat Build of Apache Camel for Quarkus, and others. No configuration-based workaround is documented; upgrading is the only recommended remediation (GitHub Advisory, Red Hat CVE).

The Quarkus project published a dedicated blog post at quarkus.io/blog/CVE-2026-50559 providing additional context for users (Quarkus Blog). The advisory was authored by cescoffier (a Quarkus core maintainer) and credits geoand as the reporter. Coverage appeared in InfoQ's Java news roundup for June 2026 and on security aggregators including BitNinja and OffSeq Radar, indicating moderate community awareness. Social media activity was observed on Bluesky and via CVEnew, reflecting routine vulnerability disclosure engagement rather than significant alarm.