{"id":"CVE-2026-50559","aliases":["EUVD-2026-38084","GHSA-qcxp-gm7m-4j5v"],"status":"published","title":"Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities","description":"Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01023,"percentile":0.63926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178","CWE-287","CWE-41","CWE-551","CWE-863"],"published":"2026-06-19T20:26:39Z","modified":"2026-11-10T02:32:29Z","fixes":[{"ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","fixed_in":["3.20.6.2","3.27.4.1","3.33.2.1","3.36.3","3.37.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.6.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0.CR1"},{"fixed":"3.27.4.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.28.0.CR1"},{"fixed":"3.33.2.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0.CR1"},{"fixed":"3.36.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.37.0.CR1"},{"fixed":"3.37.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.6.2"}]}],"versions":["0.23.0","0.23.1","0.23.2","0.24.0","0.25.0","0.26.0","0.26.1","0.27.0","0.28.0","0.28.1","1.0.0.CR1","1.0.0.CR2","1.0.0.Final","1.0.1.Final","1.1.0.CR1","1.1.0.Final","1.1.1.Final","1.10.0.CR1","1.10.0.Final","1.10.1.Final","1.10.2.Final","1.10.3.Final","1.10.4.Final","1.10.5.Final","1.11.0.Beta1","1.11.0.Beta2","1.11.0.CR1","1.11.0.Final","1.11.1.Final","1.11.2.Final","1.11.3.Final","1.11.4.Final","1.11.5.Final","1.11.6.Final","1.11.7.Final","1.12.0.CR1","1.12.0.Final","1.12.1.Final","1.12.2.Final","1.13.0.CR1","1.13.0.Final","1.13.1.Final","1.13.2.Final","1.13.3.Final","1.13.4.Final","1.13.5.Final","1.13.6.Final","1.13.7.Final","1.2.0.CR1","1.2.0.Final","1.2.1.Final","1.3.0.Alpha1","1.3.0.Alpha2","1.3.0.CR1","1.3.0.CR2","1.3.0.Final","1.3.1.Final","1.3.2.Final","1.3.3.Final","1.3.4.Final","1.4.0.CR1","1.4.0.Final","1.4.1.Final","1.4.2.Final","1.5.0.CR1","1.5.0.Final","1.5.1.Final","1.5.2.Final","1.6.0.CR1","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.CR2","1.7.0.Final","1.7.1.Final","1.7.2.Final","1.7.3.Final","1.7.4.Final","1.7.5.Final","1.7.6.Final","1.8.0.CR1","1.8.0.Final","1.8.1.Final","1.8.2.Final","1.8.3.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","2.0.0.Alpha1","2.0.0.Alpha2","2.0.0.Alpha3","2.0.0.CR1","2.0.0.CR2","2.0.0.CR3","2.0.0.Final","2.0.1.Final","2.0.2.Final","2.0.3.Final","2.1.0.CR1","2.1.0.Final","2.1.1.Final","2.1.2.Final","2.1.3.Final","2.1.4.Final","2.10.0.CR1","2.10.0.Final","2.10.1.Final","2.10.2.Final","2.10.3.Final","2.10.4.Final","2.11.0.CR1","2.11.0.Final","2.11.1.Final","2.11.2.Final","2.11.3.Final","2.12.0.CR1","2.12.0.Final","2.12.1.Final","2.12.2.Final","2.12.3.Final","2.13.0.CR1","2.13.0.Final","2.13.1.Final","2.13.2.Final","2.13.3.Final","2.13.4.Final","2.13.5.Final","2.13.6.Final","2.13.7.Final","2.13.8.Final","2.13.9.Final","2.14.0.CR1","2.14.0.Final","2.14.1.Final","2.14.2.Final","2.14.3.Final","2.15.0.CR1","2.15.0.Final","2.15.1.Final","2.15.2.Final","2.15.3.Final","2.16.0.CR1","2.16.0.Final","2.16.1.Final","2.16.10.Final","2.16.11.Final","2.16.12.Final","2.16.2.Final","2.16.3.Final","2.16.4.Final","2.16.5.Final","2.16.6.Final","2.16.7.Final","2.16.8.Final","2.16.9.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.2.2.Final","2.2.3.Final","2.2.4.Final","2.2.5.Final","2.3.0.CR1","2.3.0.Final","2.3.1.Final","2.4.0.CR1","2.4.0.Final","2.4.1.Final","2.4.2.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.2.Final","2.5.3.Final","2.5.4.Final","2.6.0.CR1","2.6.0.Final","2.6.1.Final","2.6.2.Final","2.6.3.Final","2.7.0.CR1","2.7.0.Final","2.7.1.Final","2.7.2.Final","2.7.3.Final","2.7.4.Final","2.7.5.Final","2.7.6.Final","2.7.7.Final","2.8.0.CR1","2.8.0.Final","2.8.1.Final","2.8.2.Final","2.8.3.Final","2.9.0.CR1","2.9.0.Final","2.9.1.Final","2.9.2.Final","3.0.0.Alpha1","3.0.0.Alpha2","3.0.0.Alpha3","3.0.0.Alpha4","3.0.0.Alpha5","3.0.0.Alpha6","3.0.0.Beta1","3.0.0.CR1","3.0.0.CR2","3.0.0.Final","3.0.1.Final","3.0.2.Final","3.0.3.Final","3.0.4.Final","3.1.0.CR1","3.1.0.Final","3.1.1.Final","3.1.2.Final","3.1.3.Final","3.10.0","3.10.0.CR1","3.10.1","3.10.2","3.11.0","3.11.0.CR1","3.11.1","3.11.2","3.11.3","3.12.0","3.12.0.CR1","3.12.1","3.12.2","3.12.3","3.13.0","3.13.0.CR1","3.13.1","3.13.2","3.13.3","3.14.0","3.14.0.CR1","3.14.1","3.14.2","3.14.3","3.14.4","3.15.0","3.15.0.CR1","3.15.1","3.15.2","3.15.3","3.15.3.1","3.15.4","3.15.5","3.15.6","3.15.6.1","3.15.6.2","3.15.7","3.16.0","3.16.0.CR1","3.16.1","3.16.2","3.16.3","3.16.4","3.17.0","3.17.0.CR1","3.17.1","3.17.2","3.17.3","3.17.4","3.17.5","3.17.6","3.17.7","3.17.8","3.18.0","3.18.0.CR1","3.18.1","3.18.2","3.18.3","3.18.4","3.19.0","3.19.0.CR1","3.19.1","3.19.2","3.19.3","3.19.4","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.2.10.Final","3.2.11.Final","3.2.12.Final","3.2.2.Final","3.2.3.Final","3.2.4.Final","3.2.5.Final","3.2.6.Final","3.2.7.Final","3.2.8.Final","3.2.9.Final","3.20.0","3.20.0.CR1","3.20.1","3.20.2","3.20.2.1","3.20.2.2","3.20.3","3.20.4","3.20.5","3.20.6","3.20.6.1","3.3.0","3.3.0.CR1","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0.CR1","3.4.1","3.4.2","3.4.3","3.5.0","3.5.0.CR1","3.5.1","3.5.2","3.5.3","3.6.0","3.6.0.CR1","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.6.9","3.7.0","3.7.0.CR1","3.7.1","3.7.2","3.7.3","3.7.4","3.8.0","3.8.0.CR1","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.6.1","3.9.0","3.9.0.CR1","3.9.0.CR2","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.0.CR1"},{"fixed":"3.27.4.1"}]}],"versions":["3.21.0","3.21.0.CR1","3.21.1","3.21.2","3.21.3","3.21.4","3.22.0","3.22.0.CR1","3.22.1","3.22.2","3.22.3","3.23.0","3.23.0.CR1","3.23.1","3.23.2","3.23.3","3.23.4","3.24.0","3.24.0.CR1","3.24.1","3.24.2","3.24.3","3.24.4","3.24.5","3.25.0","3.25.0.CR1","3.25.1","3.25.2","3.25.3","3.25.4","3.26.0","3.26.0.CR1","3.26.1","3.26.2","3.26.3","3.26.4","3.27.0","3.27.0.CR1","3.27.1","3.27.2","3.27.3","3.27.3.1","3.27.4"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.28.0.CR1"},{"fixed":"3.33.2.1"}]}],"versions":["3.28.0","3.28.0.CR1","3.28.1","3.28.2","3.28.3","3.28.4","3.28.5","3.29.0","3.29.0.CR1","3.29.1","3.29.2","3.29.3","3.29.4","3.30.0","3.30.0.CR1","3.30.1","3.30.2","3.30.3","3.30.4","3.30.5","3.30.6","3.30.7","3.30.8","3.31.0","3.31.0.CR1","3.31.1","3.31.2","3.31.3","3.31.4","3.32.0","3.32.0.CR1","3.32.1","3.32.2","3.32.3","3.32.4","3.33.0","3.33.0.CR1","3.33.1","3.33.1.1","3.33.2"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0.CR1"},{"fixed":"3.36.3"}]}],"versions":["3.34.0","3.34.0.CR1","3.34.1","3.34.2","3.34.3","3.34.4","3.34.5","3.34.6","3.34.7","3.35.0","3.35.0.CR1","3.35.1","3.35.2","3.35.3","3.35.4","3.36.0","3.36.0.CR1","3.36.1","3.36.2"]},{"source":"osv","ecosystem":"Maven","package":"io.quarkus:quarkus-vertx-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.37.0.CR1"},{"fixed":"3.37.0"}]}],"versions":["3.37.0.CR1"]}],"products":[{"vendor":"quarkus","product":"quarkus"},{"vendor":"quarkusio","product":"quarkus"},{"vendor":"red hat","product":"cryostat 4 on rhel 9"},{"vendor":"red hat","product":"openshift serverless"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel 3.33 for quarkus 3.33.2.sp1"},{"vendor":"red hat","product":"red hat build of apache camel 4 for quarkus 3"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of quarkus 3.20.6.sp2"},{"vendor":"red hat","product":"red hat build of quarkus 3.27.4.sp1"},{"vendor":"red hat","product":"red hat build of quarkus 3.33.2.sp1"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.29"},{"vendor":"red hat","product":"streams for apache kafka 2.9.4"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50559","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2486959","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50559.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26586","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26194","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26018","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26017","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50559","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus/commit/919b80017d85564143a845b38e9cca54aff5b3cc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qcxp-gm7m-4j5v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50559.json","tags":["advisory"]},{"url":"https://github.com/quarkusio/quarkus","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-50559","title":"Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities","description":"Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.","status":"published","published":"2026-06-19T20:26:39.322Z","modified":"2026-08-13T12:04:32.994Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-287","CWE-863","CWE-551"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-38084","description":"Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.","status":"published","published":"2026-06-19T20:26:39Z","modified":"2026-08-13T12:04:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:57.213133Z"}],"ghsa":[{"id":"GHSA-qcxp-gm7m-4j5v","title":"Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities","description":"Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix\n  parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static\n  resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.\n\n  ### Technical Details\n\n  The security layer (AbstractPathMatchingHttpSecurityPolicy) normalizes request paths using Vert.x's normalizedPath(),\n  which only decodes unreserved RFC 3986 characters (letters, digits, -, ., _, ~). It then strips matrix parameters by\n  looking for literal ; characters. This creates two mismatches:\n\n  1. Encoded semicolons (`%3B`): Since `%3B` is not decoded by normalizedPath(), the matrix parameter stripping in\n  pathWithoutMatrixParams() never sees it. The encoded semicolon and everything after it become part of the path\n  segment, causing policy matching to fail. This affects all path-policy-protected endpoints.\n  2. Static resource path mismatch: Static resource handlers (StaticHandlerImpl, FileSystemStaticHandler) perform full\n  percent-decoding via URIDecoder.decodeURIComponent() and backslash-to-slash conversion before filesystem resolution.\n  Reserved characters like `%2F` (slash) and `%5C` (backslash) that survive the security layer's partial decoding are fully\n  decoded before file serving.\n\n  REST endpoints using Quarkus REST (RESTEasy Reactive) are not affected by the `%2F/%5C` vectors because the routing layer also uses `normalizedPath()` — both security and routing agree on the path, so no mismatch exists.\n\n###  Attack Vectors\n\n  Encoded semicolon (matrix parameter smuggling), affects all path-policy-protected endpoints:\n  \n  - `/api/admin%3Bbypass=true/data`: security sees this as a single segment `admin%3Bbypass=true`, which does not match the\n   `/api/admin/* policy`. The request passes through unauthenticated.\n  - `/api/secret%3b/data`: same mechanism with lowercase hex digit.\n\n  Encoded slash/backslash on static resources, affects static files behind path policies:\n  - `/static-secret%2Fhtml`, security does not match /static-secret.html policy; static handler decodes `%2F` to `/` and may\n  resolve the file.\n  - `/static-secret%5Chtml `. static handler decodes `%5C` to `\\`, then converts to `/`.\n\n  Double encoding, affects static resources:\n  - `/secret%252Fconfidential.html`, first decode by normalizedPath() turns `%25` into `%`, producing `%2F`. Static handler's\n  second decode turns `%2F` into `/`.\n\n  The following vectors were investigated and confirmed not exploitable:\n\n  - Unreserved character encoding (`/api/adm%69n/data`): `normalizedPath()` decodes these. Both security and routing see\n  `/api/admin/data`. \n  - Null byte injection (`/api/admin%00/data`): `%00` is not decoded by `normalizedPath()`. \n  - Encoded dot segments (`/api/%2e%2e/secret/data`): Period is unreserved, so `%2e` is decoded to `.` by `normalizedPath()`,\n  then `removeDots()` normalizes `..` segments. \n  - REST endpoint bypass via `%2F/%5C`: Routing uses the same `normalizedPath()` as security. The encoded slash/backslash\n  doesn't match any route. \n\n###   Root Cause\n\n  `pathWithoutMatrixParams()` operates on the partially-decoded output of `normalizedPath()`, where reserved characters\n  remain encoded. It searches for literal ; but never sees `%3B.` The fix (`normalizePath()`) performs full percent-decoding\n   in a loop before stripping matrix parameters, removing null bytes, normalizing backslashes, and resolving dot\n  segments, aligning the security layer's view of the path with what downstream handlers resolve.\n\n###  Impact\n\n  - Unauthenticated access to endpoints protected by `quarkus.http.auth.permission` path-based policies via `%3B` smuggling\n  - Static resource exposure by bypassing path policies on protected files via `%2F/%5C`\n  - Applications using annotation-based security (`@RolesAllowed`, `@Authenticated`) on JAX-RS resources without path-based\n  policies are not affected by the `%2F/%5C` vectors, but may still be affected by `%3B` if path policies coexist\n\n###  Proof of Concept\n\n```\n  # Encoded semicolon bypass — works on any path-policy-protected endpoint\n  # Security sees \"/api/admin%3Bbypass=true/data\", doesn't match /api/admin/* policy\n  curl -v http://target/api/admin%3Bbypass=true/data\n\n  # Encoded semicolon on authenticated endpoint\n  curl -v http://target/api/secret%3b/data\n\n  # Static resource bypass via encoded slash (if static file behind path policy)\n  curl -v http://target/static-secret%2Fhtml\n\n  # Static resource bypass via encoded backslash\n  curl -v http://target/static-secret%5Chtml\n```","status":"published","published":"2026-07-29T15:40:05Z","modified":"2026-07-30T12:32:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-41","CWE-178","CWE-287","CWE-551","CWE-863"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-50559","description":"Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.","status":"published","published":"2026-06-19T21:17:02.373Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287","CWE-863","CWE-551"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-50559","title":"Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities","description":"Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.","status":"published","published":"2026-06-19T20:26:39.322Z","modified":"2026-11-10T02:32:29.456609637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-287","CWE-863"],"updated_at":"2026-11-10T02:45:42.584685Z"},{"id":"GHSA-qcxp-gm7m-4j5v","title":"Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities","description":"Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix\n  parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static\n  resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.\n\n  ### Technical Details\n\n  The security layer (AbstractPathMatchingHttpSecurityPolicy) normalizes request paths using Vert.x's normalizedPath(),\n  which only decodes unreserved RFC 3986 characters (letters, digits, -, ., _, ~). It then strips matrix parameters by\n  looking for literal ; characters. This creates two mismatches:\n\n  1. Encoded semicolons (`%3B`): Since `%3B` is not decoded by normalizedPath(), the matrix parameter stripping in\n  pathWithoutMatrixParams() never sees it. The encoded semicolon and everything after it become part of the path\n  segment, causing policy matching to fail. This affects all path-policy-protected endpoints.\n  2. Static resource path mismatch: Static resource handlers (StaticHandlerImpl, FileSystemStaticHandler) perform full\n  percent-decoding via URIDecoder.decodeURIComponent() and backslash-to-slash conversion before filesystem resolution.\n  Reserved characters like `%2F` (slash) and `%5C` (backslash) that survive the security layer's partial decoding are fully\n  decoded before file serving.\n\n  REST endpoints using Quarkus REST (RESTEasy Reactive) are not affected by the `%2F/%5C` vectors because the routing layer also uses `normalizedPath()` — both security and routing agree on the path, so no mismatch exists.\n\n###  Attack Vectors\n\n  Encoded semicolon (matrix parameter smuggling), affects all path-policy-protected endpoints:\n  \n  - `/api/admin%3Bbypass=true/data`: security sees this as a single segment `admin%3Bbypass=true`, which does not match the\n   `/api/admin/* policy`. The request passes through unauthenticated.\n  - `/api/secret%3b/data`: same mechanism with lowercase hex digit.\n\n  Encoded slash/backslash on static resources, affects static files behind path policies:\n  - `/static-secret%2Fhtml`, security does not match /static-secret.html policy; static handler decodes `%2F` to `/` and may\n  resolve the file.\n  - `/static-secret%5Chtml `. static handler decodes `%5C` to `\\`, then converts to `/`.\n\n  Double encoding, affects static resources:\n  - `/secret%252Fconfidential.html`, first decode by normalizedPath() turns `%25` into `%`, producing `%2F`. Static handler's\n  second decode turns `%2F` into `/`.\n\n  The following vectors were investigated and confirmed not exploitable:\n\n  - Unreserved character encoding (`/api/adm%69n/data`): `normalizedPath()` decodes these. Both security and routing see\n  `/api/admin/data`. \n  - Null byte injection (`/api/admin%00/data`): `%00` is not decoded by `normalizedPath()`. \n  - Encoded dot segments (`/api/%2e%2e/secret/data`): Period is unreserved, so `%2e` is decoded to `.` by `normalizedPath()`,\n  then `removeDots()` normalizes `..` segments. \n  - REST endpoint bypass via `%2F/%5C`: Routing uses the same `normalizedPath()` as security. The encoded slash/backslash\n  doesn't match any route. \n\n###   Root Cause\n\n  `pathWithoutMatrixParams()` operates on the partially-decoded output of `normalizedPath()`, where reserved characters\n  remain encoded. It searches for literal ; but never sees `%3B.` The fix (`normalizePath()`) performs full percent-decoding\n   in a loop before stripping matrix parameters, removing null bytes, normalizing backslashes, and resolving dot\n  segments, aligning the security layer's view of the path with what downstream handlers resolve.\n\n###  Impact\n\n  - Unauthenticated access to endpoints protected by `quarkus.http.auth.permission` path-based policies via `%3B` smuggling\n  - Static resource exposure by bypassing path policies on protected files via `%2F/%5C`\n  - Applications using annotation-based security (`@RolesAllowed`, `@Authenticated`) on JAX-RS resources without path-based\n  policies are not affected by the `%2F/%5C` vectors, but may still be affected by `%3B` if path policies coexist\n\n###  Proof of Concept\n\n```\n  # Encoded semicolon bypass — works on any path-policy-protected endpoint\n  # Security sees \"/api/admin%3Bbypass=true/data\", doesn't match /api/admin/* policy\n  curl -v http://target/api/admin%3Bbypass=true/data\n\n  # Encoded semicolon on authenticated endpoint\n  curl -v http://target/api/secret%3b/data\n\n  # Static resource bypass via encoded slash (if static file behind path policy)\n  curl -v http://target/static-secret%2Fhtml\n\n  # Static resource bypass via encoded backslash\n  curl -v http://target/static-secret%5Chtml\n```","status":"published","published":"2026-07-29T15:40:05Z","modified":"2026-09-10T03:51:12.00346872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178","CWE-287","CWE-41","CWE-551","CWE-863"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}