CVE-2026-76184: In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches…

High severity · published Oct 15, 2026

CVE-2026-76184

In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches…

8.2

CVSS

0.4%

EPSS

On KEV

Description

In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 33% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Eclipse Jetty · Eclipse Foundation

12.1.0 through 12.1.12; 12.0.0 through 12.0.38; 11.0.0 through 11.0.32; 10.0.0 through 10.0.32; 9.4.0 through 9.4.64 · source: vendor

Affected product

Eclipse Jetty