{"vulnerability": "cve-2026-50559", "sightings": [{"uuid": "f3569df7-8d8a-46e4-89e1-8b7b9a64d342", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50559", "type": "seen", "source": "https://gist.github.com/alon710/3db515a2eeb4d5b12d5e1d48cfe2eef8", "content": "# CVE-2026-50559: CVE-2026-50559: Authentication and Authorization Bypass via Parser Differential in Quarkus\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-50559\n\n## Summary\nA critical authentication and authorization bypass vulnerability in the Quarkus Java framework exists due to a parser differential mismatch between the HTTP security policy layer and downstream handlers. By leveraging encoded reserved characters such as semicolons, slashes, and backslashes, attackers can bypass configured path-based security policies to gain unauthorized access to secure administrative endpoints and static resources.\n\n## TL;DR\nQuarkus applications prior to 3.37.0 are vulnerable to an authentication bypass where encoded characters (%3B, %2F, %5C) prevent security filters from matching path-based policies, while downstream routers decode and execute the requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 / CWE-863\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00463 (37.7th percentile)\n- **Impact**: Authentication & Authorization Bypass\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Quarkus Java Framework\n\n## Mitigation\n\n- Upgrade to a patched version of Quarkus (3.37.0, 3.36.3, 3.33.2.1, 3.27.4.1, 3.20.6.2)\n- Configure Web Application Firewall (WAF) or API Gateway edge rules to block encoded reserved characters (%3B, %2F, %5C)\n- Adopt programmatic method-level authorization annotations (@RolesAllowed) as a defense-in-depth measure\n\n**Remediation Steps:**\n1. Identify all Quarkus deployments within the application environment.\n2. Update application build configurations (pom.xml or build.gradle) to reference a secure, patched Quarkus version.\n3. Verify the deployment by running integration tests targeting path-based security policies.\n4. Deploy perimeter WAF rules to inspect and sanitize HTTP URIs before they reach the application cluster.\n5. Perform method-level security reviews and transition from path-based authorization to programmatic annotations where applicable.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-50559) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T10:31:25.809792Z"}, {"uuid": "b7967b47-afd3-441a-a334-89ed8dcd525b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50559", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mooa7iyulz2r", "content": "Quarkus patched a semicolon auth bypass in May. CVE-2026-50559 reopens it with URL-encoded characters, so an unauthenticated request can reach protected routes and files. Patch now; the May fix does not cover it.\n\n#CVE #infosec #cybersecurity", "creation_timestamp": "2026-06-19T20:57:38.885937Z"}, {"uuid": "b42cfc88-2790-43cb-b9f3-c999d2b9ecc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50559", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mooeqikk4j2g", "content": "CVE-2026-50559 - Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities\nCVE ID : CVE-2026-50559\n \n Published : June 19, 2026, 8:26 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : Quarkus is a Java framework for building cloud-native applications. Pr...", "creation_timestamp": "2026-06-19T22:18:43.283587Z"}, {"uuid": "c37039de-e6c1-4dcc-8f62-f9376a12b126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-50559", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mps7ejvrvj2k", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-50559 \u0432 Quarkus: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/72E99481-D133-4F03-91BA-85DF881C986C", "creation_timestamp": "2026-07-04T04:18:24.281232Z"}, {"uuid": "efef84e9-8b2a-411e-9e0b-6b749bf89669", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-50559", "type": "published-proof-of-concept", "source": "https://github.com/quarkusio/quarkus/security/advisories/GHSA-qcxp-gm7m-4j5v", "content": "", "creation_timestamp": "2026-07-29T16:35:02.695583Z"}]}