Eclipse Jetty: Path parameter traversal

🗓️ 22 Jul 2026 22:57:36Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 107 Views

Jetty 12.1.8: canonicalPath may not normalize after semicolon path parameters, bypassing /admin/* security.

Reporter	Title	Published	Views	Family All 237
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-10051, CVE-2026-6790, CVE-2026-8384, CVE-2026-10050, CVE-2026-59879, CVE-2026-59880)	14 Aug 202622:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is affected by multiple vulnerabilities in Eclipse Jetty (CVE-2026-8384 and CVE-2026-19203)	9 Oct 202606:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access or information disclosure due to Jetty (CVE-2026-8384)	14 Sep 202618:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BigMemory Max is affected by Jetty vulnerabilities that could allow attackers to bypass security filters in downstream web applications.	19 Aug 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed	3 Sep 202602:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by URI path normalization vulnerability due to Eclipse Jetty	7 Aug 202612:04	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance	31 Aug 202606:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities	21 Oct 202614:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to Eclipse Jetty	26 Aug 202609:28	–	ibm
attackerkb	CVE-2026-8384	14 Jul 202608:56	–	attackerkb

Vulners

Node

org.eclipse.jetty jetty-utilRange12.1.0–12.1.8maven

org.eclipse.jetty jetty-utilRange12.0.0–12.0.34maven

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-w7x5-g22v-xqhr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-8384
github	www.github.com/jetty/jetty.project/pull/14969
github	www.github.com/jetty/jetty.project/pull/14973
github	www.github.com/jetty/jetty.project/commit/82969c77f6da46e27008b10b3c14840cd31db084
github	www.github.com/jetty/jetty.project/commit/ade27ce93a37c33278720250d85c48601230ae3f
github	www.github.com/jetty/jetty.project/releases/tag/jetty-12.0.35
github	www.github.com/jetty/jetty.project/releases/tag/jetty-12.1.9
gitlab	www.gitlab.eclipse.org/security/cve-assignment/-/work_items/108
github	www.github.com/advisories/GHSA-w7x5-g22v-xqhr

22 Jul 2026 22:57Current

7High risk

Vulners AI Score7

CVSS 3.15.3

EPSS0.0033

SSVC

CWE-647