By vendor

Quarkus vulnerabilities

Known CVEs affecting Quarkus products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-50559HIGH 7.5

  Quarkus, a popular Java framework for cloud-native applications, has a security flaw in how it enforces access controls on HTTP paths. An attacker can bypass authorization policies by embedding encoded characters—specifically encoded semicolons (%3B), slashes (%2F), or backslashes (%5C)—in request URLs. This allows unauthorized access to protected resources and sensitive functionality that should be restricted. The vulnerability affects multiple Quarkus version branches; patched versions are available across the 3.20, 3.27, 3.33, and 3.36+ series.