CVE-2026-50559: Quarkus HTTP Authorization Bypass via Encoded Characters

Technical summary

Quarkus implements HTTP path-based authorization policies to control access to application resources. The vulnerability stems from insufficient normalization or validation of URL-encoded characters before the authorization layer evaluates path rules. An attacker can craft requests containing %3B (semicolon), %2F (forward slash), or %5C (backslash) to manipulate the effective request path. When the security framework processes the authorization check, these encoded characters are not properly decoded or stripped, allowing the attacker to smuggle matrix parameters (via semicolons) or traverse into protected static resource directories. This is distinct from CVE-2026-39852, which addressed only literal (non-encoded) semicolon handling. The fix involves stricter URL normalization and validation before path-based authorization decisions are made.

Business impact

Organizations running Quarkus-based applications face direct exposure of confidential data and restricted functionality. An unauthenticated attacker can read sensitive static resources, access administrative endpoints, or trigger restricted business logic without proper credentials. This undermines the entire authorization model and could lead to data breaches, compliance violations (e.g., GDPR, PCI-DSS), and reputational damage. The attack requires no authentication, making it broadly exploitable across the internet.

Affected systems

Quarkus versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 are vulnerable. Any organization running Quarkus in production should verify their deployed version against these patched releases. If your application relies on HTTP path-based authorization (a common pattern in REST APIs and microservices), you are in scope.

Exploitability

The vulnerability is highly exploitable. It requires no authentication, no user interaction, and can be triggered over the network via simple HTTP requests with URL-encoded characters in the path. An attacker needs only to craft a malicious URL and send it to the Quarkus application. No complex prerequisites or specific configurations are needed; the flaw exists in the core authorization mechanism. Public awareness of the bypass technique increases the likelihood of opportunistic attacks.

Remediation

Upgrade Quarkus to one of the patched versions: 3.37.0 or later, 3.36.3 or later, 3.33.2.1 or 3.33.3 or later, 3.27.4.1 or 3.27.5 or later, or 3.20.6.2 or later. Identify your current version, determine the closest supported release path, and apply the update. If you cannot patch immediately, apply compensating controls (e.g., WAF rules to block requests with encoded semicolons, slashes, or backslashes in sensitive paths) as a temporary measure, but this is not a substitute for patching.

Patch guidance

Consult the official Quarkus release notes and security advisory for your version branch. Patch testing should focus on HTTP request routing and authorization enforcement—verify that both encoded and literal requests to protected paths are correctly blocked or allowed according to your policy. If you maintain custom authorization extensions, review them for similar encoding-related bypasses. Deploy patches in a staged manner: first to a non-production environment, then to staging, and finally to production during a controlled maintenance window.

Detection guidance

Monitor HTTP access logs and WAF logs for requests containing encoded characters (%3B, %2F, %5C) in path components, especially targeting known sensitive endpoints or static resource directories. Implement alerting on 403/401 responses followed by requests with the same target path but with encoded characters. Application performance monitoring and security information and event management (SIEM) systems should be tuned to flag suspicious path patterns. Conduct a baseline audit of current Quarkus versions in your environment using dependency scanning tools.

Why prioritize this

This vulnerability merits immediate attention due to its network-exploitable nature (no authentication required), high confidentiality impact, and ease of exploitation. The CVSS score of 7.5 (HIGH) reflects the lack of prerequisites and broad attack surface. Unlike the earlier CVE-2026-39852 fix, this patch addresses additional bypass techniques, suggesting attackers may have refined their methods. Organizations with public-facing Quarkus applications should prioritize patching within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 is driven by: (1) Network vector (AV:N) — no physical or local access required; (2) Low attack complexity (AC:L) — standard HTTP requests suffice; (3) No privilege required (PR:N) — unauthenticated attackers can exploit; (4) No user interaction (UI:N) — fully automated; (5) Unchanged scope (S:U) — impacts only the vulnerable system; (6) High confidentiality impact (C:H) — sensitive data exposure; (7) No integrity or availability impact (I:N, A:N) — read-only. The score reflects a serious but not critical vulnerability; systems relying on path-based authorization for sensitive data are at significant risk.

Frequently asked questions