Yüksek CVSS 7.5 PoC var
CVE-2026-50559: Quarkus: hatalı kimlik doğrulama
Açıklama (NVD)
Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.
Özet bilgiler
- Ürün
- Quarkus Quarkus
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %1,02 (yüzdelik 64)
- CWE
- CWE-287
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| quarkus-quarkus | — | — | 3.20.6.2 |
| quarkus-quarkus | 3.21.0 | — | 3.27.4.1 |
| quarkus-quarkus | 3.28.0 | — | 3.33.2.1 |
| quarkus-quarkus | 3.34.0 | — | 3.36.3 |