5186 matches found
PT-2026-114849
When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...
PT-2026-114868
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...
CVE-2026-76182
In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...
PT-2026-114870
In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous...
CVE-2026-18661
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
UBUNTU-CVE-2026-18661
In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the same url-pattern were not being applied if the web.xml had more than 1...
PT-2026-114869
In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...
Eclipse Jetty information leakage vulnerability
Eclipse Jetty 12.1.12 and earlier versions of 12.1.x, 12.0.38 and earlier versions of 12.0.x, 11.0.32 and earlier versions of 11.0.x, 10.0.32 and earlier versions of 10.0.x, and 9.4.64 and earlier versions of 9.4.x have a vulnerability involving information leakage. This vulnerability arises from...
Security Bulletin: IBM Terracotta is affected by Jetty vulnerabilities that could allow attackers to bypass security controls, hijack user sessions, or access unauthorized data
Summary IBM Terracotta utilizes Jetty as a lightweight Java-based web server and servlet container that allows developers to run web applications and provide machine-to-machine communications. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1...
Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an HTTP request smuggling vulnerability due to Eclipse Jetty
Summary Eclipse Jetty is used by IBM Integrated Analytics System as a web server and servlet container. CVE-2026-19203 affects Eclipse Jetty due to accepting a lone line-feed LF character as a terminator in chunked request parsing such as in chunk extensions, chunk data termination, or trailer...
Security Bulletin:Vulnerabilities exists in Jetty package used by IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediar...
CLEANSTART-2026-EB27094 In Eclipse Jetty, a first HTTP/1
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, a first HTTP/1...
CLEANSTART-2026-PV64921 In Eclipse Jetty, the HTTP/1
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the HTTP/1...
CLEANSTART-2026-BC80499 In Eclipse Jetty, an HTTP URI of this form: /public;/
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, an HTTP URI of this form: /public;/...
CLEANSTART-2026-RB25036 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...
CLEANSTART-2026-MN49716 In Eclipse Jetty, versions 12
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, versions 12...
CLEANSTART-2026-SN03087 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs
Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...
CLEANSTART-2026-ZE47134 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...