The vulnerability identified as CVE-2026-50559 affects Red Hat build of Quarkus versions prior to 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2. It allows attackers to bypass HTTP path-based authorization policies by exploiting advanced path normalization issues. Specifically, attackers can use encoded semicolons (%3B) to smuggle matrix parameters past security checks and encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This issue is distinct from previously known vulnerabilities involving literal semicolon stripping. Red Hat has issued security updates in the listed versions to remediate this vulnerability.

Successful exploitation of this vulnerability allows an attacker to bypass HTTP path-based authorization controls, potentially granting unauthorized access to protected resources. The CVSS score of 7.5 reflects a high severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Red Hat has released official security updates addressing this vulnerability in Red Hat build of Quarkus versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2. Users should apply these updates to remediate the issue. Before applying the update, ensure all previously released relevant errata have been applied. Refer to the Red Hat advisory RHSA-2026:26194 and official Red Hat documentation for detailed update instructions.