Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-19 | 2 | Disclosure1Patch1 |
| 2026-06-22 | 1 | Patch1 |
Excited to share this week’s Java News Roundup! Get the latest on point releases for Spring Tools, Helidon, JobRunr, and Gradle, June 2026 Open Liberty, Apache TomEE 11.0 milestone, Hibernate ORM 8.0 beta, Quarkus emergency fixes for CVE-2026-50559, and … https://ift.tt/9IeRfSu
Post summary
The post lists Java releases and highlights that Quarkus has issued emergency fixes for CVE-2026-50559, indicating a patch is available.
CVE-2026-50559 Quarkus versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 permit attackers to circumvent HTTP path-based authorization policies through two distinct methods https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50559
Post summary
The advisory notes that certain Quarkus versions allow attackers to bypass HTTP path-based authorization policies, but no PoC, exploit, patch, or evidence of active exploitation is provided.
CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP p… https://www.cve.org/CVERecord?id=CVE-2026-50559
Post summary
CVE‑2026‑50559 lists older Quarkus releases as vulnerable and indicates that newer versions provide a fix.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | quarkus | quarkus | - | - | - |