EJ
Product
Eclipse Jetty
15
CVEs
0
On KEV
9.1
Max CVSS
3
New 30D
Severity mix
Critical 2High 9Medium 4Low 0
Watch
Add Eclipse Jetty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76182 | 6.9 | Oct 15 | In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in… Affected: 12.1.0 through 12.1.12; 12.0.0 through 12.0.38; 12.1.0 through 12.1.12; 12.1.0 through 12.1.12; 12.0.0 through 12.0.38; 12.1.0 through 12.1.12; +6 more |
| CVE-2025-11143 | 6.5 | Mar 5 | The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components… Affected: 9.4.0 through 9.4.58; 10.0.0 through 10.0.26; 11.0.0 through 11.0.26; 12.0.0 through 12.0.30; 12.1.0 through 12.1.4 |
| CVE-2026-8384 | 5.3 | Jul 14 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the… Affected: 12.0.0 through 12.0.34; 12.1.0 through 12.1.8 |
| CVE-2026-6790 | 5.3 | Jul 14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present) Affected: 9.4.0 through 9.4.60; 10.0.0 through 10.0.28; 11.0.0 through 11.0.28; 12.0.0 through 12.0.34; 12.1.0 through 12.1.8 |
Showing 4