CVE-2026-8384
published 2026-07-14CVE-2026-8384: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.33%
25.9th percentile
In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).
However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppetserver | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| eclipse | jetty | >= 12.0.0 < 12.0.35 | 12.0.35 |
| eclipse | jetty | >= 12.1.0 < 12.1.9 | 12.1.9 |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.34 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.8 | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| satellite-capsule_el8 | puppetserver | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Eclipse Jetty: Path parameter traversal
ghsa·2026-07-22
CVE-2026-8384 [MEDIUM] CWE-647 Eclipse Jetty: Path parameter traversal
Eclipse Jetty: Path parameter traversal
### Description (as reported)
#### Summary
In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot
segment.
A minimal example is:
`/public;/../admin/secret`
In my local reproduction, URIUtil.canonicalPath() returns:
`/public/../admin/secret`
instead of the expected normalized path:
`/admin/secret`
When Jetty's `SecurityHandler.PathMapped` is used to protect a path prefix such as `/admin/*`, the non-normalized canonical path may not match the protected prefix. As a result, an unauthenticated request may bypass the configured path-based security constraint.
#### Tested Version
Jetty: 12.1.8
JDK: 17.0.18
Maven: 3.9.14
VulDB
Eclipse Jetty up to 12.0.34/12.1.8 Path Resolution /../ path traversal (WID-SEC-2026-2314)
vuldb·2026-07-14·CVSS 5.3
CVE-2026-8384 [MEDIUM] Eclipse Jetty up to 12.0.34/12.1.8 Path Resolution /../ path traversal (WID-SEC-2026-2314)
A vulnerability marked as problematic has been reported in Eclipse Jetty up to 12.0.34/12.1.8. This impacts an unknown function of the component Path Resolution. This manipulation of the argument /../ causes relative path traversal.
This vulnerability is tracked as CVE-2026-8384. The attack is possible to be carried out remotely. No exploit exists.
Red Hat
jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
vendor_redhat·2026-07-14·CVSS 5.3
CVE-2026-8384 [MEDIUM] CWE-22 jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).
However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
A flaw was found in Eclipse Jetty. An attacker could craft a specially formed HTTP Uniform Resource Identifier (URI) that, when processed by Jetty, results in an unresolved path. While Jetty itself is not directly affected, web appli
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-8384 maven4: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-8384 [MEDIUM] CVE-2026-8384 maven4: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
CVE-2026-8384 maven4: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).
However, web applications that rely on resolved paths being provided by Jetty may be confused wh
Bugzilla
CVE-2026-8384 python-avro: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-8384 [MEDIUM] CVE-2026-8384 python-avro: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
CVE-2026-8384 python-avro: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).
However, web applications that rely on resolved paths being provided by Jetty may be confus
Bugzilla
CVE-2026-8384 log4j: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
bugzilla·2026-08-05·CVSS 5.3
CVE-2026-8384 [MEDIUM] CVE-2026-8384 log4j: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
CVE-2026-8384 log4j: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).
However, web applications that rely on resolved paths being provided by Jetty may be confused whe
Bugzilla
CVE-2026-8384 jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
bugzilla·2026-07-14·CVSS 5.3
CVE-2026-8384 [MEDIUM] CVE-2026-8384 jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
CVE-2026-8384 jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
In Eclipse Jetty, an HTTP URI of this form:
/public;/../admin/secret.txt
results in an unresolved path of:
/public/../admin/secret.txt
instead of the expected:
/admin/secret.txt
Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).
However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
2026-07-14
Published