High [CVE-2026-50559] Authorization bypass in HTTP path-based policies via encoded characters

Quarkus is a Java framework for building cloud-native applications.

Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources.

This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.

A flaw was found in Quarkus. This could allow unauthorized access to protected static resources, leading to information disclosure.

This is critical in deployments where Quarkus applications serve sensitive static content and rely solely on path-based authorization. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-551.

Affected products named by the advisory: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1; Red Hat build of Quarkus 3.20.6.SP2; Red Hat build of Quarkus 3.27.4.SP1; Red Hat build of Quarkus 3.33.2.SP1; and 10 more.