Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access or information disclosure due to Jetty (CVE-2026-8384)

Summary Eclipse Jetty path traversal/path normalization vulnerability can allow crafted URIs containing semicolon path parameters and .. sequences to bypass path-based authorization checks in applications relying on Jetty's canonicalized paths. IBM Sterling Secure Proxy has addressed the applicab...

CLEANSTART-2026-AB17721 Security fixes in solr 10.0.0-r6

Package solr version 10.0.0-r6 fixes 4 vulnerabilities: CVE-2026-8384, CVE-2026-6790, CVE-2026-10051, CVE-2026-10050...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: akhq, confluent-kafka, dependency-track, druid, trino, strimzi-kafka-operator, neo4j, solr...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: apache-hop-fips, solr-fips, jenkins, confluent-kafka-jre-bcfips, spark-fips, spark-kubernetes-operator-fips, traccar-fips, traccar, trino, spark, apache-jena-fuseki, spark-kubernetes-operator, confluent-kafka, strimzi-kafka-operator-fips, kafka-fips, akhq, neo4j,...

CVE-2026-8384

creationtimestamp| type| source ---|---|--- 2026-07-14 11:58:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqm5q2hfk72w 2026-07-20 05:39:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr2ldikcy42i 2026-07-20 05:44:37+00:00| seen|...

DEBIAN-CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...