6.9
Medium
CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such…
Description
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Jetty 12.1 | 12.1.0 → 12.1.12 | No fix stated |
| Eclipse Jetty 12.0 | 12.0.0 → 12.0.38 | No fix stated |
References
- github.com github.com
- gitlab.eclipse.org gitlab.eclipse.org
Timeline
- Published
- Last modified
Other CVEs of Eclipse Jetty
The 16 CVEs of Eclipse Jetty →
CVE-2026-18661
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec…
8.8
High
CVE-2026-77711
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy…
8.2
High
CVE-2026-76184
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to…
8.2
High
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually…
8.7
High