CVE-2026-50559

Executive Summary

CVE-2026-50559 is a critical authorization bypass vulnerability in the Quarkus Java framework, affecting versions prior to the patched releases. The flaw allows an unauthenticated attacker to bypass HTTP path-based authorization policies by smuggling encoded characters—specifically encoded semicolons (%3B), encoded slashes (%2F), and encoded backslashes (%5C)—into the request path. This enables access to protected static resources and the injection of matrix parameters that are not properly sanitized by the security layer.

This vulnerability is distinct from CVE-2026-39852, which only addressed literal semicolon stripping. The current issue exploits the fact that the security layer does not normalize encoded characters before applying path-based rules, while the underlying HTTP server (Vert.x) does decode them. This discrepancy allows an attacker to craft a request that appears benign to the security filter but is interpreted as a different path by the server.

The vulnerability has a CVSS score of 7.5 (High), with a vector string indicating network-based, low-complexity attacks that require no privileges or user interaction. The primary impact is confidentiality, as an attacker can read arbitrary static resources protected by path-based policies.

Supply Chain & Package Security

Quarkus is a Java framework distributed via Maven Central. Organizations using Quarkus should immediately update to the patched versions. The vulnerability affects the core HTTP routing and security components, which are part of the quarkus-vertx-http and quarkus-security modules. Dependency scanning tools should flag versions below the patched thresholds.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The exploitation does not affect other components beyond the vulnerable one.
• Confidentiality (C): High (H) – An attacker can read protected static resources, potentially exposing sensitive data.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service impact.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to unauthorized access to sensitive files.

Deep Dive & Mechanics

The root cause of CVE-2026-50559 lies in the inconsistent handling of URL-encoded characters between the security layer and the HTTP server in Quarkus.

1. Path-Based Authorization: Quarkus allows developers to define authorization policies based on URL paths (e.g., /admin/* requires authentication). These policies are enforced by a security filter that inspects the raw request path.

2. Encoding Bypass: The security filter checks the path before URL decoding. An attacker can encode special characters like ;, /, or \ using percent-encoding (e.g., %3B for ;, %2F for /, %5C for \). The filter sees a benign path (e.g., /public/..%2Fadmin/secret.txt) and allows access.

3. Server-Side Decoding: The underlying Vert.x HTTP server decodes the URL after the security check. The decoded path becomes /public/../admin/secret.txt, which resolves to the protected resource /admin/secret.txt. This path traversal allows access to files outside the intended scope.

4. Matrix Parameters: Encoded semicolons (%3B) can be used to inject matrix parameters (e.g., /path;matrix=value). These parameters are not stripped by the security layer, allowing an attacker to smuggle additional parameters that may affect application logic.

The vulnerability is a classic example of a "double decoding" or "path normalization" bypass, where the security layer and the application layer interpret the same request differently.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Security filter checks the raw path without decoding
String rawPath = request.path();
if (rawPath.startsWith("/admin")) {
    // Deny access
    return 403;
}
// Server later decodes the path
String decodedPath = URLDecoder.decode(rawPath, "UTF-8");
// Serve the resource at decodedPath

Patched Code (Conceptual):

// Normalize and decode the path before authorization
String rawPath = request.path();
String normalizedPath = normalizePath(rawPath); // Decode %2F, %5C, %3B
if (normalizedPath.startsWith("/admin")) {
    return 403;
}
// Serve the resource at normalizedPath

The patch ensures that the security filter normalizes the path by decoding percent-encoded characters and resolving path traversal sequences (e.g., ..) before applying authorization policies.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Quarkus application with path-based authorization (e.g., /admin/* requires authentication).
• The application serves static resources from a directory (e.g., /static/).

Exploit Steps:

1. Identify a protected resource: For example, /admin/config.properties is protected.
2. Craft a bypass request: Use URL encoding to bypass the security filter.
   • Path traversal: GET /static/..%2Fadmin/config.properties HTTP/1.1
   • Semicolon smuggling: GET /admin%3B/config.properties HTTP/1.1 (if the filter strips semicolons but not encoded ones)
   • Backslash bypass: GET /static/..%5Cadmin/config.properties HTTP/1.1
3. Send the request: The security filter sees /static/..%2Fadmin/config.properties and allows it (since it starts with /static/). The server decodes it to /static/../admin/config.properties, which resolves to /admin/config.properties.

Example cURL command:

curl -v "http://target.com/static/..%2Fadmin/config.properties"

Expected Output:

HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 123

[Contents of /admin/config.properties]

Blue Team (Defender)

Detection Steps:

1. Monitor for encoded characters in paths: Look for requests containing %2F, %5C, or %3B in the URL path.
2. Check for path traversal patterns: Detect sequences like ..%2F or ..%5C that indicate an attempt to escape the intended directory.
3. Audit access logs: Identify requests that access protected resources (e.g., /admin/) from unexpected paths (e.g., /static/).
4. Implement input validation: Ensure that all URL paths are normalized and decoded before authorization checks.

Lab Setup:

• Victim: A Quarkus application (version < 3.37.0) with a protected /admin endpoint and a public /static directory.
• Attacker: A machine with curl or a web browser.
• Network: Both machines on the same network or the attacker can reach the victim's IP.

Indicators of Compromise (IOCs)

• URL Patterns:
  • %2F (encoded forward slash) in the path, especially with .. (e.g., ..%2F)
  • %5C (encoded backslash) in the path (e.g., ..%5C)
  • %3B (encoded semicolon) in the path (e.g., /path%3Bmatrix)
• Access Log Entries:
  • Requests to /static/ or other public paths that result in access to /admin/ or other protected paths.
  • HTTP status 200 for resources that should require authentication.
• Server Logs:
  • Warnings about path normalization or decoding errors.
  • Unusual patterns in the request.path field.

Detection Engineering

YARA Rule

rule CVE_2026_50559_Quarkus_Auth_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2026-50559 via encoded characters in HTTP paths"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $encoded_slash = /%2[fF]/
        $encoded_backslash = /%5[cC]/
        $encoded_semicolon = /%3[bB]/
        $path_traversal = /\.\.%2[fF]|\.\.%5[cC]/
    condition:
        any of ($encoded_slash, $encoded_backslash, $encoded_semicolon) and $path_traversal
}

Sigma Rule

title: Quarkus Authorization Bypass via Encoded Characters
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with encoded path traversal characters targeting Quarkus applications
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '%2F'
            - '%5C'
            - '%3B'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-50559 Quarkus Authorization Bypass via Encoded Characters"; flow:to_server,established; content:"%2F"; http_uri; content:".."; http_uri; distance:0; within:10; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-50559 Quarkus Authorization Bypass via Encoded Backslash"; flow:to_server,established; content:"%5C"; http_uri; content:".."; http_uri; distance:0; within:10; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2026-50559 Quarkus Authorization Bypass via Encoded Semicolon"; flow:to_server,established; content:"%3B"; http_uri; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Quarkus: Upgrade to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, or 3.20.6.2 (or later).
2. Apply Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing %2F, %5C, or %3B in the path, especially when combined with ...
3. Review Access Logs: Check for any signs of exploitation in historical logs.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation and normalization for all URL paths at the application level.
2. Least Privilege: Ensure that static resources are not stored in directories that overlap with protected paths.
3. Security Testing: Include path traversal and encoding bypass tests in your CI/CD pipeline.
4. Monitor for CVEs: Subscribe to Quarkus security advisories for future vulnerabilities.

Workaround (if patching is delayed):

• Disable path-based authorization for static resources and use alternative authentication mechanisms (e.g., cookies, tokens).
• Implement a custom filter that normalizes paths before authorization checks.

Valters IT