| CVE-2026-18661 |
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec…
|
8.8
High
|
Oct 15, 2026 |
| CVE-2026-77711 |
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy…
|
8.2
High
|
Oct 15, 2026 |
| CVE-2026-76184 |
In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to…
|
8.2
High
|
Oct 15, 2026 |
| CVE-2026-76182 |
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such…
|
6.9
Medium
|
Oct 15, 2026 |
| CVE-2026-12611 |
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually…
|
8.7
High
|
Sep 8, 2026 |
| CVE-2026-19203 |
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary…
|
8.3
High
|
Sep 8, 2026 |
| CVE-2026-19204 |
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to…
|
8.7
High
|
Sep 7, 2026 |
| CVE-2026-10050 |
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
|
8.7
High
|
Aug 4, 2026 |
| CVE-2024-7708 |
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak
|
7.5
High
|
Jul 14, 2026 |
| CVE-2026-8384 |
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:…
|
5.3
Medium
|
Jul 14, 2026 |
| CVE-2026-6790 |
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host…
|
5.3
Medium
|
Jul 14, 2026 |
| CVE-2026-10051 |
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests…
|
6.9
Medium
|
Jul 14, 2026 |
| CVE-2026-2332 |
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to…
|
7.4
High
|
Apr 14, 2026 |
| CVE-2026-5795 |
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable
|
7.4
High
|
Apr 8, 2026 |
| CVE-2026-1605 |
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed…
|
7.5
High
|
Mar 5, 2026 |
| CVE-2025-11143 |
The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual…
|
3.7
Low
|
Mar 5, 2026 |