HIGH 7.5 GitHub
CVE-2026-50559
Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix
parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static
resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.
### Technical Details
The security layer (AbstractPathMatchingHttpSecurityPolicy) normalizes request paths using Vert.x's normalizedPath(),
which only de
Affected Products
- maven/io.quarkus:quarkus-vertx-http < 3.20.6.2
- maven/io.quarkus:quarkus-vertx-http >= 3.21.0.CR1, < 3.27.4.1
- maven/io.quarkus:quarkus-vertx-http >= 3.28.0.CR1, < 3.33.2.1
- maven/io.quarkus:quarkus-vertx-http >= 3.34.0.CR1, < 3.36.3
- maven/io.quarkus:quarkus-vertx-http >= 3.37.0.CR1, < 3.37.0
References
- https://github.com/advisories/GHSA-qcxp-gm7m-4j5v
- https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v
- https://nvd.nist.gov/vuln/detail/CVE-2026-50559
- https://github.com/quarkusio/quarkus/commit/919b80017d85564143a845b38e9cca54aff5b3cc
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-07-29 via GitHub. Affected: maven/io.quarkus:quarkus-vertx-http < 3.20.6.2, maven/io.quarkus:quarkus-vertx-http >= 3.21.0.CR1, < 3.27.4.1, maven/io.quarkus:quarkus-vertx-http >= 3.28.0.CR1, < 3.33.2.1 and 2 more.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.