CVE-2026-50559
Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix
parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static
resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping.
Technical Details
The security layer (AbstractPathMatchingHttpSecurityPolicy) normalizes request paths using Vert.x's normalizedPath(),
which only decodes unreserved RFC 3986 characters (letters, digits, -, ., _, ~). It then strips matrix parameters by
looking for literal ; characters. This creates two mismatches:
1. Encoded semicolons (%3B): Since %3B is not decoded by normalizedPath(), the matrix parameter stripping in
pathWithoutMatrixParams() never sees it. The encoded semicolon and everything after it become part of the path
segment, causing policy matching to fail. This affects all path-policy-protected endpoints.
2. Static resource path mismatch: Static resource handlers (StaticHandlerImpl, FileSystemStaticHandler) perform full
percent-decoding via URIDecoder.decodeURIComponent() and backslash-to-slash conversion before filesystem resolution.
Reserved characters like %2F (slash) and %5C (backslash) that survive the security layer's partial decoding are fully
decoded before file serving.
REST endpoints using Quarkus REST (RESTEasy Reactive) are not affected by the %2F/%5C vectors because the routing layer also uses normalizedPath() — both security and routing agree on the path, so no mismatch exists.
Attack Vectors
Encoded semicolon (matrix parameter smuggling), affects all path-policy-protected endpoints:
- /api/admin%3Bbypass=true/data: security sees this as a single segment admin%3Bbypass=true, which does not match the
/api/admin/* policy. The request passes through unauthenticated.
- /api/secret%3b/data: same mechanism with lowercase hex digit.
Encoded slash/backslash on static resources, affects static files behind
⚡ Watch CVE-2026-50559
Get an email if CVE-2026-50559 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-50559)