5191 matches found
CLEANSTART-2026-JC61209 In Eclipse Jetty, an HTTP URI of this form: /public;/
Security vulnerability affects the kafka package. In Eclipse Jetty, an HTTP URI of this form: /public;/...
CLEANSTART-2026-PQ26679 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)
Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...
CLEANSTART-2026-CI10932 In Eclipse Jetty, a first HTTP/1
Security vulnerability affects the kafka package. In Eclipse Jetty, a first HTTP/1...
CLEANSTART-2026-XU35369 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes
Security vulnerability affects the kafka package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...
PT-2026-108501
Security vulnerability affects the kafka package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...
PT-2026-108364
Security vulnerability affects the kafka package. In Eclipse Jetty, a first HTTP/1...
PT-2026-108437
Security vulnerability affects the kafka package. In Eclipse Jetty, an HTTP URI of this form: /public;/...
ANT-2026-Y9CTVKPP · jetty/jetty.project · Denial of Service / Resource Exhaustion
denial-of-service high GHSA-85fq-fc5f-7j7g Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-Y9CTVKPP: WebSocket reserved opcode...
Security Bulletin: IBM App Connect Enterprise is affected by multiple vulnerabilities in Eclipse Jetty.
Summary IBM App Connect Enterprise Toolkit is affected by multiple vulnerabilities in Eclipse Jetty. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the...
jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...
CVE-2026-12611
A flaw was found in Jetty. A remote attacker can exploit a race condition in the server's handling of HTTP/2 RSTSTREAM and GOAWAY frames. This can lead to blocking writes that are never unblocked, causing all server threads to become unresponsive. The primary impact is a Denial of Service DoS for...
CVE-2026-19204
A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending a specially crafted WebSocket frame with an unknown operation code opcode and a very large declared payload length. When auto-fragmentation is enabled, these unknown opcodes bypass the normal maximum frame size...
CVE-2026-19203
A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/1.1 chunked requests. This can cause Jetty and an intermediary proxy to interpret different request boundaries, potentially leading to HTTP request smuggling. This issue arises from Jetty...
CLEANSTART-2026-SV46004 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap
Security vulnerability affects the apache-nifi package. A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap...
Oracle Enterprise Manager Cloud Control (September 2026 CSPU)
The 13.5.0.0 and 24.1.0.0 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
CVE-2026-52852
Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. org.traccar.api.resource.GroupResource permits...
OPENSUSE-SU-2026:11804-1 jetty-annotations-9.4.58-6.1 on GA media
These are all security issues fixed in the jetty-annotations-9.4.58-6.1 package on the GA media of openSUSE Tumbleweed...
Eclipse Jetty HTTP Request Processing
The vulnerability of Eclipse Jetty servlet containers is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to carry out attacks by substituting HTTP requests...
ROOT-APP-MAVEN-CVE-2026-1605 CVE-2026-1605 in org.eclipse.jetty:jetty-server - Patched by Root
Root has patched CVE-2026-1605 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available...