Summary
CVE-2026-50559 is a high-severity HTTP path-based authorization bypass vulnerability in Quarkus, a Java framework for building cloud-native applications. An unauthenticated remote attacker can bypass authorization policies by sending HTTP requests containing specially percent-encoded characters in the URL path, gaining unauthorized access to protected endpoints and static resources. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) and has been patched by the Quarkus project across all supported version streams.
Technical details
- Root cause: A path-normalization inconsistency between Quarkus’s security layer and its routing layer. The security layer evaluates authorization policies against the raw, undecoded URL path — which preserves encoded matrix parameters and path separators — while the routing layer normalizes the path before dispatching requests, stripping those same encoded characters. This mismatch allows crafted URLs to pass authorization checks while still routing to protected endpoints.
- Trigger conditions: An attacker sends an HTTP request to a protected endpoint or static resource with encoded characters embedded in the URL path. No authentication, privileges, or user interaction are required.
- Attack vector: Remote, unauthenticated, over the network. Attackers can exploit the flaw using:
- Encoded semicolons (
%3B) to smuggle matrix parameters past the security layer, causing it to evaluate a path that does not match protected path patterns - Encoded forward slashes (
%2F) or backslashes (%5C) to traverse path segments and access protected static resources
- Encoded semicolons (
- Relationship to CVE-2026-39852: This is a distinct issue from CVE-2026-39852, which addressed only literal (unencoded) semicolon stripping. CVE-2026-50559 exploits percent-encoded variants that were not covered by the earlier fix.
- Impact: Unauthorized disclosure of data protected behind path-based authorization policies. Confidentiality impact is rated High; integrity and availability are not affected.
Affected software
- Quarkus all versions prior to 3.20.6.2
- Quarkus 3.27.x prior to 3.27.4.1
- Quarkus 3.33.x prior to 3.33.2.1
- Quarkus 3.36.x prior to 3.36.3
- Quarkus all versions prior to 3.37.0
Severity
- CVSS v3.1 Base Score: 7.5 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
-
Immediate action — upgrade to a patched release:
- 3.37.0 (latest)
- 3.36.3
- 3.33.3 or 3.33.2.1
- 3.27.5 or 3.27.4.1
- 3.20.6.2
The Quarkus CLI command
quarkus updatecan be used to apply the upgrade automatically. -
If immediate patching is not feasible: Apply perimeter controls (e.g., WAF or reverse proxy rules) to block or normalize requests containing
%3B,%2F, or%5Cin URL path segments corresponding to protected resources. This is a temporary measure only — patching remains the required remediation.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

