Is CVE-2026-50559 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 0%.

What products does CVE-2026-50559 affect?

Tracked products affected include Quarkus. Check the version you run to see whether it is affected.

How do I fix CVE-2026-50559?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2026-50559

Q: What is CVE-2026-50559?

CVE-2026-50559 is a high-severity software vulnerability (Improper authentication) with a CVSS score of 7.5. Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons

HIGH severity · CVSS 7.5 · Improper authentication

7.5CVSS HIGH

Summary

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

Quarkus

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2026-50559

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information