UBUNTU-CVE-2026-18659

In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods...

UBUNTU-CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

Linux Distros Unpatched Vulnerability : CVE-2026-19864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the...

CVE-2026-19864

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...

Linux Distros Unpatched Vulnerability : CVE-2026-76184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches...

Linux Distros Unpatched Vulnerability : CVE-2026-77711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly...

Linux Distros Unpatched Vulnerability : CVE-2026-18660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that...

UBUNTU-CVE-2026-19864

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...

Linux Distros Unpatched Vulnerability : CVE-2026-18659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, and jetty-eeN- servlet, the Jakarta Spec constraints defined as...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, as well as 10.0.0 and 11.0.0, when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e., q parameters, the server may enter a Denial-of-Service DoS state due to high CPU usage in processing...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision

A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain...

Information Exposure

Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain proxy authentication credentials by crafting a server that responds with a 407...

Information Exposure

Overview org.eclipse.jetty:jetty-client is an is an asynchronous http client module fro jetty server. Affected versions of this package are vulnerable to Information Exposure in the HttpClient. An attacker can obtain authentication credentials intended for one path by controlling redirect respons...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or TryFilesFilter process. An attacker can manipulate query parameters by crafting a request path containing reserve...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or TryFilesFilter process. An attacker can manipulate query parameters by crafting a request path containing reserve...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or TryFilesFilter process. An attacker can manipulate query parameters by crafting a request path containing reserve...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the TryPathsHandler or...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to improper handling of hostnames in the proxy process. An attacker can bypass access restrictions by supplying hostnames that differ only in letter casing. Remediation Upgrade...

Improper Handling of Case Sensitivity

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to improper handling of hostnames in the proxy process. An attacker can bypass access...