What is the CVSS score of CVE-2026-50559?

CVE-2026-50559 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Quarkus are affected by CVE-2026-50559?

Quarkus Java framework contains a critical vulnerability that permits unauthenticated users to bypass security controls and access protected application resources without authorization.. A patch is available.

Is there a public PoC exploit available for CVE-2026-50559?

Yes, a public proof-of-concept exploit is available for CVE-2026-50559. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-50559?

24 hours: Identify all systems running Quarkus versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2. 7 days: No vendor-released patch identified-implement WAF rules blocking encoded characters (%3B, %2F, %5C) in URLs; disable matrix parameters in Quarkus configuration if not required. 30 days: Prepare and execute upgrade plan for patched Quarkus versions when vendor releases patches.

Quarkus CVE-2026-50559

EUVD-2026-38084 HIGH

Improper Authentication (CWE-287)

2026-06-19 GitHub_M

GHSA-qcxp-gm7m-4j5v

Authentication Bypass Java Quarkus

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request with no user interaction; bypass exposes protected resources (C:H) but the advisory describes read access only, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 19, 2026 - 23:17 EUVD

Analysis Generated

Jun 19, 2026 - 20:47 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

121 maven packages depend on io.quarkus:quarkus-vertx-http (31 direct, 90 indirect)

Ecosystem-wide dependent count for version 3.21.0.CR1.

DescriptionCVE.org

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

Articles & Coverage 1

News 3 New Java Vulnerabilities - 3 High Severity, No POC Available Jun 19, 2026

AnalysisAI

Authentication bypass in Quarkus Java framework allows remote unauthenticated attackers to circumvent HTTP path-based authorization policies by smuggling encoded semicolons (%3B) as matrix parameters or by using encoded slashes (%2F) and backslashes (%5C) to reach protected static resources. Affects all Quarkus versions prior to the 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 patch line. No public exploit identified at time of analysis, though the issue is a documented bypass of the prior CVE-2026-39852 fix.

Technical ContextAI

Quarkus is a Kubernetes-native Java framework (cpe:2.3:a:quarkusio:quarkus) that ships an HTTP layer with declarative path-based security policies (@PermissionsAllowed, application.properties quarkus.http.auth.permission.*). The flaw is a CWE-287 authentication bypass rooted in inconsistent URL normalization between the security interceptor and the request dispatcher: the authorization layer evaluates a normalized path while the downstream router decodes %3B, %2F, and %5C differently, so matrix-parameter segments and encoded path separators reach protected resources without being matched against the policy. This is explicitly a regression-class follow-up to CVE-2026-39852, which only stripped literal semicolons and missed percent-encoded variants and encoded slash/backslash traversal into static resource handlers.

RemediationAI

Vendor-released patch: upgrade to Quarkus 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, or 3.20.6.2 - whichever matches your current maintenance line - per GHSA-qcxp-gm7m-4j5v (https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v). Until upgrade is possible, place a reverse proxy or WAF in front of the application that rejects or normalizes requests containing %3B, %2F, and %5C in the path component before they reach Quarkus, accepting that this may break legitimate clients that send matrix parameters; alternatively, move authorization enforcement from path-based policies to method-level @RolesAllowed/@PermissionsAllowed annotations on the JAX-RS resources themselves so encoded-path tricks cannot smuggle past the security layer, at the cost of refactoring effort. Audit served static resources and remove sensitive files from any directory exposed through the Quarkus static-resource handler.