Bug 2486959 (CVE-2026-50559)

Summary:	CVE-2026-50559 io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abhraj, abrianik, ant, anujha, aschwart, asoldano, aszczucz, avibelli, bbaranow, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, chfoley, cmah, dandread, dhanak, dkreling, dlofthou, drichtar, drosa, dsimansk, eaguilar, ebaron, ewittman, fmongiar, ggrzybek, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jkoehler, jmartisk, jnethert, jolong, jpechane, jraez, kaycoth, kingland, kverlaen, lphiri, lthon, manderse, mnovotny, mosmerov, mposolda, msvehla, nipatil, nwallace, olubyans, pantinor, parichar, pberan, pdelbell, pesilva, pgallagh, pjindal, pmackay, probinso, rgodfrey, rguimara, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, security-response-team, smaestri, ssilvert, sthorger, swoodman, tasato, thjenkin, tqvarnst, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Quarkus. A remote attacker could bypass HTTP path-based authorization policies by using specially crafted encoded semicolons, slashes, or backslashes in HTTP requests. This could allow unauthorized access to protected static resources, leading to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-06-17

Description OSIDB Bzimport 2026-06-09 11:02:53 UTC

Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix
parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static.

Comment 2 errata-xmlrpc 2026-06-17 16:18:21 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 3.27.4.SP1

Via RHSA-2026:26018 https://access.redhat.com/errata/RHSA-2026:26018

Comment 3 errata-xmlrpc 2026-06-17 21:02:38 UTC

This issue has been addressed in the following products:

  Red Hat build of Quarkus 3.20.6.SP2

Via RHSA-2026:26194 https://access.redhat.com/errata/RHSA-2026:26194

Comment 4 errata-xmlrpc 2026-06-17 23:05:29 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1

Via RHSA-2026:26586 https://access.redhat.com/errata/RHSA-2026:26586

Comment 5 errata-xmlrpc 2026-07-02 00:04:33 UTC

This issue has been addressed in the following products:

  Streams for Apache Kafka 2.9.4

Via RHSA-2026:34608 https://access.redhat.com/errata/RHSA-2026:34608

Comment 6 errata-xmlrpc 2026-07-29 19:54:42 UTC

This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:48151 https://access.redhat.com/errata/RHSA-2026:48151