Eclipse Foundation Eclipse Jetty

• CVE-2026-77711 High 8.2 When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming fro 0.4%
• CVE-2026-76184 High 8.2 In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials 0.4%
• CVE-2026-76182 Medium 6.9 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI p 0.3%
• CVE-2026-12611 High 8.7 A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. 0.4%
• CVE-2026-19203 High 8.3 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP req 0.3%
• CVE-2026-19204 High 8.7 A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This o 0.5%
• CVE-2026-10050 High 8.7 Digest authentication lossy encoding 0.6%
• CVE-2024-7708 High 7.5 For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can 0.4%
• CVE-2026-8384 Medium 5.3 In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/se 0.3%
• CVE-2026-6790 Medium 5.3 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not en 0.3%
• CVE-2026-10051 Medium 6.9 In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailer 0.4%
• CVE-2026-2332 High 7.4 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing 1.3%
• CVE-2026-5795 High 7.4 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an ear 0.5%
• CVE-2026-1605 High 7.5 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding r 0.7%
• CVE-2025-11143 Low 3.7 The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security 0.2%