Improper Resolution of Path Equivalence in Quarkus - CVE-2026-50559
Published: June 17, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper resolution of path equivalence in AbstractPathMatchingHttpSecurityPolicy and static resource handlers when handling crafted request paths containing encoded semicolons, slashes, or backslashes. A remote attacker can send a specially crafted request to disclose sensitive information.
Path-based authorization policies can be bypassed via encoded semicolons on protected endpoints, while protected static resources can be exposed via encoded slashes, backslashes, or double-encoded path separators. REST endpoints using Quarkus REST are not affected by the encoded slash and backslash vectors because routing and security use the same normalized path.
Affected software
Enterprise Build of Quarkus
Red Hat build of Quarkus
How to mitigate CVE-2026-50559
Enterprise Build of Quarkus - addressed in versions 3.27.4.SP1, 3.33.2.SP1
Red Hat build of Quarkus - update to 3.20.6.SP2