Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 9.2.26 and earlier, 9.3.25 and earlier, as well as 9.4.15 and earlier, the server is vulnerable to XSS attacks if a remote client uses a specially formatted URL against the DefaultServlet or ResourceHandler that is configured to display a listing of directory contents...

Astra Linux – Vulnerability in Jetty9

Jetty is a Java-based web server and servlet engine. An HTTP/2 SSL connection that is established and becomes TCP congested may be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the serve...

CVE-2026-34151: Path Traversal: '../filedir'

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected...

Linux Distros Unpatched Vulnerability : CVE-2026-12611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and t...

SUSE CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

SUSE CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

Security Bulletin: IBM Informix HQ affected by Vulnerabilities (CVE-2026-6790, CVE-2025-11143, and CVE-2026-2332) in third-party library Jetty.

Summary IBM InformixHQ is affected by several vulnerabilities in Jetty. IBM InformixHQ has been updated to use the latest Jetty release. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request...

Security Bulletin:Vulnerabilities exists in NPS of IBM Netezza Appliance

Summary Vulnerabilities identified in NPS of IBM Netezza Software have been addressed in version 11.3.1.3-IF3. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0,...

CLEANSTART-2026-ZI25974 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-BA42566 In Eclipse Jetty, the HTTP/1

Multiple security vulnerabilities affect the apache-zookeeper package. In Eclipse Jetty, the HTTP/1. See references for individual vulnerability details...

Linux Distros Unpatched Vulnerability : CVE-2026-19203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request...

Security Bulletin: IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass.

Summary IBM SPSS Modeler is affected by an Eclipse Jetty vulnerability that may allow authentication bypass. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by Eclipse Jetty Digest Authentication Bypass Vulnerability

Summary SPSS Collaboration and Deployment Services is affected by Eclipse Jetty Digest Authentication Bypass Vulnerability. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-10050 DESCRIPTION: In Eclipse Jetty, the Digest authentication server-side component...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to a race condition in the server when handling RSTSTREAM and GOAWAY frames. An attacker can cause the server to become unresponsive by sending specially crafted HTTP/2 requests...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), com.blazemeter.jmeter:jmeter-bzm-http2 (>=3.0.0, <=3.0.1) +695 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.1.0, <=12.1.9)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.1.0, =0.1.7, =3.0.0, =8.0.0, =3.0.0, =2.4.2, =5.0.0, =3.0.0-beta, =4.2.4, =4.2.4, =2.10.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0 and more Source cves: CVE-2026-12611 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYHTTP2-19653589...

biz.netcentric.cq.tools.accesscontroltool:sling-maximum-version-environment (>=4.2.0, <=4.2.4), com.atlan:package-toolkit-testing (>=5.3.1, <=7.4.1) +1033 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.0.0.alpha0, <=12.0.36)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.0.0.alpha0, =4.2.0, =5.3.1, =2.6.0-rc1, =2.0.0, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.230 and more Source cves: CVE-2026-12611 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYHTTP2-19653589...