Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3,
    3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be
    bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using
    encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue
    from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1,
    3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch. (CVE-2026-50559)

ID	Name	Product	Family	Type	Severity
457955	Echo: io.quarkus:quarkus-vertx-http: security update to 3.20.6.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
457955	Echo: io.quarkus:quarkus-vertx-http: security update to 3.20.6.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
445463	SCA: security update for io.quarkus:quarkus-vertx-http (GHSA-qcxp-gm7m-4j5v)	Tenable Cloud Security	SCA Checks	Local	high
445463	SCA: security update for io.quarkus:quarkus-vertx-http (GHSA-qcxp-gm7m-4j5v)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-50559

high

Tenable Plugins

high

high

high

high