Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access or information disclosure due to Jetty (CVE-2026-8384)

Summary Eclipse Jetty path traversal/path normalization vulnerability can allow crafted URIs containing semicolon path parameters and .. sequences to bypass path-based authorization checks in applications relying on Jetty's canonicalized paths. IBM Sterling Secure Proxy has addressed the applicab...

CLEANSTART-2026-AB17721 Security fixes in solr 10.0.0-r6

Package solr version 10.0.0-r6 fixes 4 vulnerabilities: CVE-2026-8384, CVE-2026-6790, CVE-2026-10051, CVE-2026-10050...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: druid, akhq, confluent-kafka, solr, neo4j, strimzi-kafka-operator, dependency-track, trino...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: kafka-fips, kafka, jenkins, spark, confluent-kafka-jre-bcfips, spark-kubernetes-operator, traccar-fips, solr-fips, neo4j, trino, wso2is, apache-hop, confluent-kafka, apache-hop-fips, solr, apache-jena-fuseki, druid, akhq, dependency-track, strimzi-kafka-operator,...

ai.agentscentral:agentj-jetty (>=0.0.4, <=0.0.6), app.cash.tempest:tempest-testing-jvm (>=1.4.0, <=2025.04.17.121601-f8f94b6) +2353 more potentially affected by CVE-2026-8384 via org.eclipse.jetty:jetty-util (>=12.0.0, <=12.0.34)

org.eclipse.jetty:jetty-util MAVEN version =12.0.0, =0.0.4, =1.4.0, =1.4.0, =7.0.0, =4.2.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-8384 Source advisory: GHSA-W7X5-G22V-XQHR...

CVE-2026-8384

creationtimestamp| type| source ---|---|--- 2026-07-14 11:58:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqm5q2hfk72w 2026-07-20 05:39:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr2ldikcy42i 2026-07-20 05:44:37+00:00| seen|...

DEBIAN-CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +1973 more potentially affected by CVE-2026-8384 via org.eclipse.jetty:jetty-util (>=12.1.0, <=12.1.8)

org.eclipse.jetty:jetty-util MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.1 and more Source cves: CVE-2026-8384 Source advisory: MEND:CVE-2026-8384...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...