CVE-2026-76184

In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...

CVE-2026-76184

In Eclipse Jetty , the HttpClient component is vulnerable to a path traversal issue during redirects. If an attacker controls the redirects, they can provide a path like /secure/../evil. The client incorrectly matches authentication credentials against /secure instead of normalizing the path to /...

CVE-2026-76184

In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...

PT-2026-114848

In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...

CVE-2026-77711: Exposure of Sensitive Information to an Unauthorized Actor

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

CVE-2026-76184: Exposure of Sensitive Information to an Unauthorized Actor

In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...

CVE-2026-76184

In Eclipse Jetty, HttpClient may receive a redirect of the form: /secure/../evil If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the...

CVE-2026-77711

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

PT-2026-114849

When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the Proxy-Authentication header, which arrives to the serve...

Eclipse Jetty information leakage vulnerability

Eclipse Jetty 12.1.12 and earlier versions of 12.1.x, 12.0.38 and earlier versions of 12.0.x, 11.0.32 and earlier versions of 11.0.x, 10.0.32 and earlier versions of 10.0.x, and 9.4.64 and earlier versions of 9.4.x have a vulnerability involving information leakage. This vulnerability arises from...

CLEANSTART-2026-XL17660 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

CLEANSTART-2026-FO83563 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the wso2am package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

CLEANSTART-2026-LH05062 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the sonarqube package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290

Summary IBM Maximo Manage application in IBM Maximo Application Suite uses httpclient5-5.6.3.jar and is vulnerable to CVE-2026-71290. This bulletin contains information regarding how to address these vulnerabilities. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname...

CLEANSTART-2026-EK15836 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

Security vulnerability affects the apache-nifi package. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message...

Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_1861)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221861 advisory. apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-13956 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_2202)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222202 advisory. dotnet: excess memory allocation via HttpClient causes DoS CVE-2022-23267 dotnet: malicious content causes high CPU and memory usage CVE-2022-29117 dotnet:...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-5.0 / aspnetcore-targeting-pack-5.0 / etc Multiple Vulnerabilities (crlsa-2022_2200)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222200 advisory. dotnet: excess memory allocation via HttpClient causes DoS CVE-2022-23267 dotnet: malicious content causes high CPU and memory usage CVE-2022-29117 dotnet:...

Rocky Linux 8 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2022_1860)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221860 advisory. apache-httpclient: incorrect handling of malformed authority component in request URIs CVE-2020-13956 Tenable has extracted the preceding description block directly...

CLEANSTART-2026-SO94492 HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header va...

CVE-2026-64607 affects multiple packages. HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. See references for individual...