# CVE-2026-50559: Quarkus authorization bypass via encoded path characters

Source: https://junglewise.ai/threats/cve-2026-50559-quarkus-authorization-bypass-via-encoded-path-characters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-50559 · Severity: high · CVSS 7.5 · Published 2026-06-19

Quarkus, a popular Java framework for building cloud-native applications, contains a security flaw in how it handles web request paths. An attacker can use specially crafted web addresses (using encoded characters like semicolons or slashes) to trick the system into bypassing security checks. This could allow unauthorized users to access restricted data or private files that should be protected by the application's security policies.

Technologies: [io.quarkus:quarkus-vertx-http (Maven)](https://junglewise.ai/threats/technologies/io-quarkus-quarkus-vertx-http). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-50559 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50559 being exploited in the wild.

**How severe is CVE-2026-50559?** High severity, with a CVSS score of 7.5, published 19 June 2026.

**Which products and versions are affected?** io.quarkus:quarkus-vertx-http (Maven) ECOSYSTEM:introduced=0,fixed=3.20.6.2; Quarkus < 3.20.6.2, >= 3.21.0.CR1, < 3.27.4.1, >= 3.28.0.CR1, < 3.33.2.1, >= 3.34.0.CR1, < 3.36.3, >= 3.37.0.CR1, < 3.37.0, < 3.37.0, < 3.36.3, < 3.33.2.1, < 3.33.3, < 3.27.4.1, < 3.27.5, < 3.20.6.2.

**Is there a fix for CVE-2026-50559?** Yes. io.quarkus:quarkus-vertx-http (Maven): upgrade to 3.20.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50559 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50559?** Check whether you run io.quarkus:quarkus-vertx-http (Maven) or Quarkus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.quarkus:quarkus-vertx-http (Maven): upgrade to 3.20.6.2 or later

  ```sh
  # set io.quarkus:quarkus-vertx-http to 3.20.6.2 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in the AbstractPathMatchingHttpSecurityPolicy component of Quarkus. The security layer uses Vert.x's normalizedPath(), which only decodes unreserved characters, while downstream handlers (like StaticHandlerImpl) perform full percent-decoding. This discrepancy allows attackers to bypass path-based authorization policies using encoded semicolons (%3B) to hide matrix parameters from the security layer, or encoded slashes (%2F) and backslashes (%5C) to access protected static resources. The root cause is that the security layer's path normalization does not align with the decoding behavior of the resource handlers. Patches are available in versions 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, and 3.37.0.

## Affected products

- Quarkus Quarkus Vert.x HTTP < 3.20.6.2, >= 3.21.0.CR1, < 3.27.4.1, >= 3.28.0.CR1, < 3.33.2.1, >= 3.34.0.CR1, < 3.36.3, >= 3.37.0.CR1, < 3.37.0

## Identifiers

- CVE-2026-50559
- GHSA-qcxp-gm7m-4j5v

## Timeline

- 2026-06-17: disclosed
- 2026-06-19: advisory: NVD published date
- 2026-07-29: patched: GitHub Advisory updated with final patch details

## References

- [https://api.github.com/users/geoand](https://api.github.com/users/geoand)
- [https://github.com/geoand](https://github.com/geoand)
- [https://api.github.com/users/geoand/gists%7B/gist_id%7D](https://api.github.com/users/geoand/gists%7B/gist_id%7D)
- [https://api.github.com/users/geoand/repos](https://api.github.com/users/geoand/repos)
- [https://avatars.githubusercontent.com/u/4374975?v=4](https://avatars.githubusercontent.com/u/4374975?v=4)
- [https://api.github.com/users/geoand/events%7B/privacy%7D](https://api.github.com/users/geoand/events%7B/privacy%7D)

## Related threats

- [Quarkus authorization bypass via semicolon in HTTP path](https://junglewise.ai/threats/cve-2026-39852-quarkus-authorization-bypass-via-semicolon-in-http-path)
- [Quarkus HTTP vulnerable to incorrect evaluation of permissions](https://junglewise.ai/threats/cve-2023-4853-quarkus-http-vulnerable-to-incorrect-evaluation-of-permissions)
- [Cross-site Scripting in Quarkus](https://junglewise.ai/threats/cve-2023-0044-cross-site-scripting-in-quarkus)
- [Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed](https://junglewise.ai/threats/cve-2022-4147-quarkus-cors-filter-allows-simple-get-and-post-requests-with-an)