Voozh

Vulnerabilities

CVE-2026-50559 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

👁 NIST CVSS score

NIST: NVD

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2026:26017	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:26018	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:26194	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:26586	redhat-SADP
https://access.redhat.com/security/cve/CVE-2026-50559	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2486959	redhat-SADP
https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v	GitHub, Inc.	Exploit Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json	redhat-SADP

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	👁 cwe source acceptance level NIST GitHub, Inc.
CWE-287	Improper Authentication	GitHub, Inc.
CWE-551	Incorrect Behavior Order: Authorization Before Parsing and Canonicalization	redhat-SADP

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

4 change records found show changes

CVE Modified by redhat-SADP 6/29/2026 11:20:47 PM

Action	Type	Old Value
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Added	CWE	CWE-551
Added	Reference	https://access.redhat.com/errata/RHSA-2026:26017
Added	Reference	https://access.redhat.com/errata/RHSA-2026:26018
Added	Reference	https://access.redhat.com/errata/RHSA-2026:26194
Added	Reference	https://access.redhat.com/errata/RHSA-2026:26586
Added	Reference	https://access.redhat.com/security/cve/CVE-2026-50559
Added	Reference	https://bugzilla.redhat.com/show_bug.cgi?id=2486959
Added	Reference	https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json
Added	Affected	Record truncated, showing 2048 of 2288 characters. View Entire Change Record [{"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1","defaultStatus":"affected","cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.20.6.SP2","defaultStatus":"affected","cpes":["cpe:/a:redhat:quarkus:3.20::el8"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.4.SP1","defaultStatus":"affected","cpes":["cpe:/a:redhat:quarkus:3.27::el8"]},{"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.2.SP1","defaultStatus":"affected","cpes":["cpe:/a:redhat:quarkus:3.33::el8"]},{"vendor":"Red Hat","product":"Cryostat 4","defaultStatus":"affected","cpes":["cpe:/a:redhat:cryostat:4"]},{"vendor":"Red Hat","product":"OpenShift Serverless","defaultStatus":"affected","cpes":["cpe:/a:redhat:serverless:1"]},{"vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","defaultStatus":"affected","cpes":["cpe:/a:redhat:apache_camel_hawtio:4"]},{"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","defaultStatus":"affected","cpes":["cpe:/a:redhat:camel_quarkus:3"]},{"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","defaultStatus":"affected","cpes":["cpe:/a:redhat:apicurio_registry:3"]},{"vendor":"Red Hat","product":"Red Hat build of Debezium 3","defaultStatus":"affected","cpes":["cpe:/a:redhat:debezium:3"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","defaultStatus":"affected","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift_devspaces:3"]},{"vendor":"Red Hat","product":"streams for Apache Kafka 2","defaultStatus":"affected","cpes":["cpe:/a:redhat:amq_streams:2"]},{"vendor":"Red

Quick Info

CVE Dictionary Entry:
CVE-2026-50559
NVD Published Date:
06/19/2026
NVD Last Modified:
06/29/2026
Source:
GitHub, Inc.

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50559

⇱ NVD - CVE-2026-50559