CLEANSTART-2026-WA43103 In Eclipse Jetty Server, versions 9

Security vulnerability affects the apache-hive package. In Eclipse Jetty Server, versions 9...

CLEANSTART-2026-ER01200 In Eclipse Jetty, versions 9

Security vulnerability affects the apache-hive package. In Eclipse Jetty, versions 9...

CLEANSTART-2026-RM27801 In Eclipse Jetty versions 1

Security vulnerability affects the apache-hive package. In Eclipse Jetty versions 1...

CLEANSTART-2026-BS31525 In Eclipse Jetty version 9

Security vulnerability affects the apache-hive package. In Eclipse Jetty version 9...

CLEANSTART-2026-BA58800 Jetty through 9

Security vulnerability affects the apache-hive package. Jetty through 9...

CLEANSTART-2026-YN29187 In Eclipse Jetty, the HTTP/1

Security vulnerability affects the apache-hive package. In Eclipse Jetty, the HTTP/1...

CLEANSTART-2026-MK68457 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the apache-nifi-registry package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

CLEANSTART-2026-BB15937 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

CVE-2026-6790 affects multiple packages. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. See references for individual vulnerability details...

CLEANSTART-2026-AF46685 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes

CVE-2026-10050 affects multiple packages. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. See references for individual vulnerability details...

CLEANSTART-2026-RP24727 In Eclipse Jetty, a first HTTP/1

Security vulnerability affects the trino package. In Eclipse Jetty, a first HTTP/1...

Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty

Summary IBM SPSS Modeler is affected by vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host a...

CLEANSTART-2026-BU33192 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the rundeck package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the HDFS layer are now fixed in 5.2.3.10 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the HDFS layer and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.10 or higher and 6.0.1.1 or higher Vulnerability Details CVEID:CVE-2026-46340 DESCRIPTION: Netty is a network...

Astra Linux – Vulnerability in Jetty9

Jetty is a Java-based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepted the + character that followed the content-length value in an HTTP/1 header field. This was more permissive than what is allowed by the RFC, and other servers routinely...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0alpha0 to 10.0.1, and 11.0.0alpha0 to 11.0.1, CPU usage can reach 100% when receiving a large invalid TLS frame...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0alpha1 through 10.0.0.beta2, and 11.0.0alpha1 through 11.0.0.beta2O, on Unix-like systems, the system’s temporary directory is shared among all users on that system. A collocated user can observe the process of creating a temporary...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 7.x, 8.x, 9.2.27 and earlier, 9.3.26 and earlier, and 9.4.16 and earlier, the server running on any operating system and Jetty version combination will display a 404 error in the output, indicating that no Context matching the requested path was found. The default server...

Security Bulletin: Due to the use of HTTP/1.1 with Jetty server, IBM Sterling Control Center is vulnerable to Inconsistent Interpretation of HTTP Requests (CVE-2026-19203)

Summary HTTP/1.1 with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary...

Security Bulletin: Due to the use of HTTP/2 requests to a Jetty server, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-12611)

Summary HTTP/2 requests with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http2-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-12611 DESCRIPTION: A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never...

Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)

Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...