Homepage

Improper Authentication Affecting hono package, versions <2.7.0-r35

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

Social Trends
Trending on 𝕏
EPSS
1.02% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-HONO-18470298
  • published31 Jul 2026
  • disclosed19 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Jun 2026

CVE-2026-50559  (opens in a new tab)
CWE-287  (opens in a new tab)
CWE-863  (opens in a new tab)

How to fix?

Upgrade Chainguard hono to version 2.7.0-r35 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream hono package and not the hono package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2, Quarkus HTTP path-based authorization policies can be bypassed using encoded semicolons (%3B) to smuggle matrix parameters past the security layer, and using encoded slashes (%2F) or backslashes (%5C) to access protected static resources. This is a distinct issue from CVE-2026-39852, which addressed only literal semicolon stripping. Versions 3.37.0, 3.36.3, 3.33.2.1, 3.33.3, 3.27.4.1, 3.27.5, and 3.20.6.2 contain a patch.